Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

Attackers hijacked over 300 Tor exit relays in early October, redirecting SSH connections to intercept login credentials. The attack was initially detected through a changed-key warning, and the Tor Project quickly implemented measures to block the affected relays. The incident stemmed from a vulnerability in the Ebury backdoor, which was used to compromise two servers and subsequently spread to other relays. The Tor Project urges relay operators to check for signs of the implant and implement security measures.