www.it-connect.fr
Tor Network: 333 Compromised Exit Relays Intercepted SSH Connections to Spread Ebury
In early October 2026, 333 compromised Tor exit relays were redirecting SSH connections to attacker-controlled servers to steal passwords and infect target machines with Ebury. Here’s what we know.
This case was revealed on October 20 by researcher Kaba, in a post published on his blog. It all started on Friday, October 2, in the morning: while connecting to one of his servers over SSH via Tor, he ran into the following message: "WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!". You know, the message that appears when you reinstall a machine or change its SSH keys... Except this time, the fingerprint being presented belonged to a rogue server.
As a reminder, Tor routes traffic through several relays operated by volunteers. The last one, the exit relay, establishes the connection to the final destination. The network has about 3,000 exit relays: according to Kaba, the attackers controlled nearly 10% of them.
What happens if you ignore the warning? The rogue server impersonates yours. If you log in with a password, it captures it in transit. It then opens its own connection to your real server and forwards your commands to it: everything appears to work normally, except it can see everything you do over SSH. A textbook example of a man-in-the-middle attack.
But that’s not all, because at the same time, it opens a second connection to your server in an attempt to install Ebury. This Linux malware embeds itself in OpenSSH and then intercepts the credentials of everyone who connects to the machine. Ebury is a botnet active since 2009 and has already infected several hundred thousand machines.
How These Relays Were Exposed
Kaba relied on exitmap, a Tor Project tool. His script passed an SSH connection, relay by relay, between two servers he controlled: the first checked the fingerprint it received, the second checked the source address. Out of roughly 3,000 relays tested, about a dozen presented a fake fingerprint and more than 300 others redirected traffic to the same 12 interception servers.
Alerted that very evening, the Tor Project’s Network Health team, responsible for spotting malicious relays and excluding them from the network, was very surprised: "We had never seen an attack of this type", it told the researcher. The relays were marked BadExit on October 4, and Tor clients stopped using them as exits. On October 5, hiro from the Tor Project posted an alert on the tor-relays mailing list: Linux hosts had been compromised, and the attacker was editing the torrc file of middle relays to turn them into exit relays.
The Compromise of Tor Relays
On the victim side, the most complete testimony comes from Zimmer, who manages the Quetzalcoatl relay family. In a postmortem published on October 7, he confirms the presence of Ebury 1.8.3 on two of his servers, including the VPS he used to administer his infrastructure. On August 28, the attacker logged in there using the operator account password, with no failed attempts at all: he therefore most likely knew it in advance. That same password was used for sudo and was stored in plaintext in a script, on both machines. A pretty bad blunder...!
To stay under the radar, Ebury does not modify any files installed by packages. It drops a fake libkeyutils library next to the real one, then redirects the symbolic link that pointed to the original so it points to the fake one instead. Integrity verification tools such as dpkg -V or debsums therefore see nothing unusual. Once loaded by sshd, Ebury can spring into action: SSH encryption does protect the password while it is in transit, but sshd must decrypt it to verify it. That is when Ebury grabs it, exactly as it was entered.
How were so many operators compromised? The theory of a hacked hosting provider is circulating, but has not been confirmed. "Given the number of servers infected by Ebury between 2009 and 2023 (400,000!), there are very likely other compromised Tor relays", says Marc-Étienne M. Léveillé, who has been studying Ebury for 13 years, in his response to Zimmer’s postmortem.
In short: you should never ignore an SSH host key change warning.
