Unknown attackers took over more than 300 Tor exit nodes and set them to favor unencrypted email traffic and send SSH connections through servers the attackers controlled, a researcher reported on October 20.
Exit nodes are the last hop in the Tor network, where traffic leaves the anonymizing relay chain and reaches the open internet. Whatever is not encrypted at that point can be read by whoever runs the node. SSH is the standard tool for logging into remote servers securely, so rerouting those sessions puts the attacker in the middle of connections that admins treat as private.
According to Tor volunteers, the hijacking began in late August. The attacker used a valid password that had been reused to get into a Tor management server, then installed Ebury, a Linux backdoor first discovered 12 years ago. From there, the attacker connected over SSH to a second Tor server, called Switzerland2, using an RSA key. With administrative control of Switzerland2, the attacker installed Ebury on it too, then reconfigured settings on two exit nodes that machine hosted.
The notable part is how ordinary the way in was. Nothing here broke Tor's cryptography or its anonymity design. The attacker walked through a reused credential into the machinery that runs the network, and a backdoor more than a decade old did the rest.
That shifts the practical risk. Anyone who sent email over Tor without encryption was exposed by choice of protocol, not by a flaw in Tor itself. SSH users have a usual safeguard in the host key warning their client shows when a server's identity changes, which is worth heeding.
For the Tor Project and its volunteers, the lesson is about administration. A network built to avoid single points of trust still depends on management servers, and those are only as strong as the weakest password protecting them.