{"id":183976,"date":"2026-10-23T23:40:30","date_gmt":"2026-10-23T21:40:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/okolo-10-vyhodnyh-uzlov-tor-byli-vovlecheny-v-ataku-po-perehvatu-ssh-podklyuchenij"},"modified":"2026-10-23T23:40:35","modified_gmt":"2026-10-23T21:40:35","slug":"around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","title":{"rendered":"About 10% of the Tor exit nodes were involved in an attack to intercept SSH connections.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Details of the incident have been published, during which attackers managed to gain control of 333 exit nodes in the Tor network (there are about 3000 exit nodes in total in Tor) and orchestrate the interception of unencrypted traffic and redirection of SSH connections. The attack began on October 2 (Friday evening) but was detected and started to be blocked on October 4. By October 5, all compromised servers were shut down by operators or the attackers themselves. The investigation revealed that the attackers gained access to the servers two months before the attack on Tor users and installed the Ebury 1.8.3 malware on the compromised systems.<\/p>\n
The goal of the attack was to intercept passwords, keys, and confidential information in the transit unencrypted traffic, as well as to capture SSH passwords. During the analysis of unencrypted traffic, the attackers focused on unencrypted requests to mail servers. To encourage a rollback to unencrypted operation on exit nodes, network ports used to establish encrypted communication channels with the mail servers were blocked. servers<\/a>Unencrypted traffic was analyzed on the fly.<\/p>\n
![](\"\/wp-content\/uploads\/2026\/10\/1492f0a0863241d34912571630e91370.png\")
<\/center><\/p>\n