As cited
Copy frozen at (site build).
threat intel
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes
A threat actor compromised over 330 Tor relays in early October, infecting them with Ebury Linux malware and repurposing them as exit nodes to intercept SSH connections and downgrade email traffic. The campaign remained undetected for three days until discovered by a Swiss engineer and reported to the Tor Project security team. The compromised nodes represented approximately 10% of Tor's exit relay capacity.
Why it matters: Tor users who routed traffic through the hijacked exit nodes between October 2 and 5 faced interception of SSH sessions and unencrypted email communications; practitioners should review whether their organizations or users relied on Tor during this window and consider the exposure of credentials or sensitive data transmitted through those relays.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes
A threat actor compromised over 330 Tor relays in early October, infecting them with Ebury Linux malware and repurposing them as exit nodes to intercept SSH connections and downgrade email traffic. The campaign remained undetected for three days until discovered by a Swiss engineer and reported to the Tor Project security team. The compromised nodes represented approximately 10% of Tor's exit relay capacity.
Why it matters: Tor users who routed traffic through the hijacked exit nodes between October 2 and 5 faced interception of SSH sessions and unencrypted email communications; practitioners should review whether their organizations or users relied on Tor during this window and consider the exposure of credentials or sensitive data transmitted through those relays.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes
A threat actor compromised over 330 Tor relays in early October, infecting them with Ebury Linux malware and repurposing them as exit nodes to intercept SSH connections and downgrade email traffic. The campaign remained undetected for three days until discovered by a Swiss engineer and reported to the Tor Project security team. The compromised nodes represented approximately 10% of Tor's exit relay capacity.
Why it matters: Tor users who routed traffic through the hijacked exit nodes between October 2 and 5 faced interception of SSH sessions and unencrypted email communications; practitioners should review whether their organizations or users relied on Tor during this window and consider the exposure of credentials or sensitive data transmitted through those relays.
- Source published
- First seen by Cybersecurity Tracker