Affected Systems
Over 300 Tor exit relays compromised October 1-5, 2026. Affected users who connected to SSH servers via Tor during this window, accepted unfamiliar host keys, and used password authentication. Attack peaked at 7.46% of Tor's total exit capacity. No specific vendor products affected; impacts Linux-based Tor relay operators and SSH users routing through Tor.
Exploitation Status
Active exploitation confirmed October 1-5, 2026. Attack was detected and mitigated by Tor Project on October 4-5. Attackers redirected SSH traffic from 333 exits to 12 interception servers, capturing passwords in real-time. Ebury backdoor deployment observed on compromised systems. Campaign is now contained; all malicious relays flagged BadExit by October 5.
Business Impact
Users who authenticated to SSH servers over Tor between October 1-5 and accepted changed or new host keys may have credentials compromised. Attackers gained real-time access to SSH sessions and deployed Ebury backdoor on some systems. Key-based SSH authentication was not vulnerable. Encrypted email ports (IMAPS/POP3S) were closed on affected relays while plaintext mail and Telnet were opened. No ongoing risk as malicious relays are now blocked from Tor consensus.
Urgency
🟠Within 24 hours
Recommended Actions
- Identify users who connected to SSH servers via Tor between October 1-5, 2026, and force password resets on those accounts immediately
- Search OpenSSH known_hosts files for ED25519 key fingerprint SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E to identify potentially compromised connections
- Scan SSH servers for Ebury backdoor indicators if accessed via Tor during the attack window; check for suspicious OpenSSH library modifications
- Enforce key-based SSH authentication and disable password authentication where feasible to prevent similar credential interception attacks
- For Tor relay operators: audit torrc configuration files for unauthorized changes, particularly exit policies enabling port 22 or disabling encrypted mail ports