🔒Over 300 Tor Exit Nodes Removed After SSH Attack
Tor Exit Nodes Infected, SSH Traffic Intercepted
TL;DR
Over 300 Tor exit nodes were removed after being compromised in an SSH attack. Attackers intercepted unencrypted data and redirected SSH connections to interception servers, highlighting the need for extra security measures.
Over 300 Tor exit nodes were removed on October 20, 2026, after being compromised by attackers who intercepted unencrypted data and redirected SSH connections to interception servers. This attack, which began in August, highlights the importance of securing SSH connections and disabling password authentication. The attackers gained access to the servers two months earlier and used exitmap to identify infected nodes. The Tor network health team responded quickly, marking the relays as BadExit and shutting them down.
Key Points
Over 300 Tor exit nodes were removed on October 20, 2026.
Attackers intercepted unencrypted data and redirected SSH connections to interception servers.
The attack began in August 2026, with compromised exit nodes identified on October 4.
Tor network health team marked compromised relays as BadExit and shut them down.
A honeypot was used to trick attackers into logging in, revealing use of paramiko and Ebury.
Why It Matters
If you're running a server that uses SSH connections, this attack is a wake-up call. The compromised exit nodes intercepted unencrypted data and redirected SSH connections to interception servers. This highlights the need to disable password authentication and treat relays/bridges as highly targeted production machines.
Comments
Be the first to comment
Enjoyed this article?
Get it daily. 7am. Free. Reads in 5 minutes.
Join 3,569 builders reading daily.