Breaches and incidentsBriefReported by a reputable outlet, citing the company
Tor network: 333+ exit relays hijacked to intercept SSH passwords
From about 1 to 5 Oct, attackers changed exit policies so SSH traffic went to 12 interception servers that harvested passwords when users accepted a new...
- Disclosed
What happened
- From about 1 to 5 Oct, attackers changed exit policies so SSH traffic went to 12 interception servers that harvested passwords when users accepted a new host key. Researcher “kaba” found 333 of about 3,000 exits on 2 Oct; directory data shows 377 relays from 59 operators; peak 7.46% of exit capacity on 4 Oct. Key-based logins were not exposed.
- Technique: edited torrc on compromised hosts. Root cause at the main operator (“Zimmer”, Quetzalcoatl family): a reused plaintext password and SSH password auth on an internet-facing management server; Ebury 1.8.3 installed. Entry into the other 58 operators is unexplained.
- Attribution: unknown.
- Response: Tor directory authorities applied BadExit/MiddleOnly flags from 4 Oct; none left in consensus by 5 Oct.
Sources
- https://thehackernews.com/2026/10/attackers-hijacked-over-300-tor-exit.html
- https://www.secureworld.io/industry-news/tor-exit-relay-hijack-root-cause
- https://kaba.cx/posts/20261020_Tor/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.