Mass Tor Exit Node Hijack Exposes SSH and Email Traffic to Interception

Unknown actors seized control of 333 Tor exit nodes over a three-day window in early October, reconfiguring them to divert SSH sessions to a dozen attacker-operated interception hosts and to block encrypted email ports while leaving cleartext channels open. The campaign began with credential reuse on a Tor management server, followed by deployment of the decade-old Ebury Linux backdoor and lateral movement to a secondary relay named Switzerland2 via an SSH key that investigators could not locate in the authorized_keys file.

How the compromise unfolded

With administrative access to Switzerland2, the operators modified exit policies on two hosted relays, eventually extending the malicious configuration to all 333 nodes. SSH traffic entering the Tor network was silently proxied to the interception farm; users who dismissed the host-key warning inadvertently surrendered credentials. Simultaneously, ports 25, 465, 587, 993, and 995 — used for SMTP, IMAP, and POP over TLS — were dropped, while unencrypted equivalents remained reachable, creating a downgrade vector for email interception.

The breach was discovered when a Tor volunteer, identified as Kaba, encountered an SSH host-key mismatch on October 4. The fingerprint SHA256:6baCZCPsl+ did not match the expected destination, triggering the standard OpenSSH warning. Prompt reporting by the Tor community limited the exposure window to roughly 72 hours, though the full extent of credential or message harvest remains unknown.

Why it matters for GPU and AI infrastructure

Organizations that route model-training jobs, dataset transfers, or administrative SSH sessions through anonymity networks must treat exit-node integrity as part of their supply-chain threat model. A compromised exit relay can undermine encryption guarantees, expose API keys, and inject malicious payloads into container images pulled over Tor. Hardened, audited GPU cloud environments — such as those operated by AiGpu — eliminate reliance on volunteer-run anonymity layers for sensitive workloads, providing dedicated, encrypted interconnects and verified supply-chain provenance for AI hardware and software stacks.