Hacked Tor exits intercepted SSH logins and planted Ebury backdoors

On 5 October the Tor Project warned relay operators that hacked Linux relays had been turned into exits to intercept SSH connections. kaba.cx found them by pinning each of the roughly 3,000 exits with exitmap: 333 exits, a tenth of all exits, redirected port 22 to one of 12 interception servers. Click past the host-key warning and they steal your password, watch the session and install the Ebury OpenSSH backdoor over a second connection. One affected operator’s timeline blames one password for SSH, sudo and the backup passphrase, in cleartext in a helper script. Their Ebury 1.8.3 is newer than ESET’s public IOCs and sails past dpkg -V, because it drops its own setuid library and re-points a symlink. Marc-Etienne M. Léveillé replied that 1.8.3 has been around since at least June 2026 and, with some 400,000 servers backdoored between 2009 and 2023, more relays are most likely compromised. The new exit policies also closed IMAPS and POP3S, so mail only crossed those relays in cleartext, and it all started on a Friday morning, presumably betting on a quiet weekend.