{"id":183976,"date":"2026-10-23T23:40:30","date_gmt":"2026-10-23T21:40:31","guid":{"rendered":"https:\/\/prohoster.info\/blog\/news\/okolo-10-vyhodnyh-uzlov-tor-byli-vovlecheny-v-ataku-po-perehvatu-ssh-podklyuchenij"},"modified":"2026-10-23T23:40:35","modified_gmt":"2026-10-23T21:40:35","slug":"around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","status":"publish","type":"post","link":"https:\/\/prohoster.info\/nl\/blog\/news\/around-10-percent-of-tor-exit-nodes-were-involved-in-an-ssh-connection-hijacking-attack","title":{"rendered":"Ongeveer 10% van de uitgaande Tor-knooppunten was betrokken bij een aanval op het onderscheppen van SSH-verbindingen.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
Details of the incident have been published, during which attackers managed to take control of 333 exit nodes of the Tor network (there are about 3000 exit nodes in total in Tor) and organize interception of unencrypted traffic and redirection of SSH connections. The attack began on October 2 (Friday evening), but was detected and started to be blocked on October 4. On October 5, all compromised servers were shut down by operators or the attackers themselves. Investigations revealed that the attackers gained access to the servers two months prior to the attack on Tor users and installed malware Ebury 1.8.3 on the compromised systems.<\/p>\n
The goal of the attack was to intercept passwords, keys, and confidential information in unencrypted transit traffic, as well as to capture SSH passwords. When analyzing unencrypted traffic, the attackers focused on non-encrypted requests to mail servers. To encourage a rollback to non-encrypted work on exit nodes, network ports used for establishing an encrypted communication channel with the mail servers were blocked. servers<\/a>. Unencrypted traffic was analyzed in real-time.<\/p>\n
![](\"\/wp-content\/uploads\/2026\/10\/1492f0a0863241d34912571630e91370.png\")
<\/center><\/p>\n