Attackers hijack 300+ Tor exit relays to intercept SSH password logins and deploy Ebury 1.8.3 backdoor

Linha do tempo

1. thehackernews.com ↗ · pub. 21/10/2026 07:30 · coletado 21/10 09:00

   Attackers hijack 300+ Tor exit relays via Ebury to intercept SSH password logins

   ler a análise desta fonte ocultar

   Attackers took over more than 300 Tor exit relays in early October 2026 and rewrote their exit policies so SSH (port 22) traffic was redirected to 12 interception servers that harvested passwords. Researcher kaba found 333 redirecting exits in an October 2 scan, and public directory data shows 377 relays run by 59 operators switched to the attacker's policy between October 1 and 4, peaking at 7.46% of exit capacity. The Tor Project flagged the relays BadExit/MiddleOnly from October 4 and none remained in the consensus by October 5. A post-mortem by relay operator Zimmer (Quetzalcoatl family) shows two of his servers were backdoored with Ebury 1.8.3 after a password-reuse compromise. Attribution and the entry method for the other 58 operators are unknown; 71 of 101 relays hosted at FranTech Solutions/BuyVM switched, which raises the question of a hoster-level compromise.

   Technical Details

   • Attackers edited torrc to open port 22 on 342 relays that had blocked it and turned 24 non-exit relays into exits. The same change closed IMAPS/POP3S and opened plaintext POP3/IMAP on most relays.
   • Exits redirected SSH to interception servers that presented their own host key (about a dozen exits in the October 2 scan) or passed the connection through without altering it (about 300). Users who accepted the key and typed a password exposed it. The interceptor then proxied the session, logged in separately with the stolen password, checked for sudo and ran a base64-encoded Perl installer. Key-based logins could not be relayed because the signature is bound to the session.
   • On Zimmer's hosts, the attacker logged in to the management server (Contabo) on August 28 with a reused operator password, gained root within five minutes, installed Ebury, and pivoted to a FranTech VPS (Switzerland2) about an hour later. The root cause was one password reused for SSH, sudo and the backup passphrase, stored in plaintext, with SSH password authentication enabled. "Offline" relay master keys were also in the backup on the management server.
   • Ebury 1.8.3 is a single setuid library, /usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10.2, with the libkeyutils.so.1 symlink pointing at it. It evades dpkg -V and debsums, survived a reboot, and leaves no login records. Version 1.8.3 has existed since at least June 2026, and ESET's script has been updated by Marc-Etienne M. Léveillé to cover it.
   • Other operators reported a fake uppercase CRON daemon and NAT rules redirecting port 22, which Zimmer's servers did not show, so it is unclear whether one actor is behind all cases. A hidden process named snf ran on Switzerland2 with unknown function.
   • Indicators: source IP 185.225.226[.]62 (August 28 login); abstract UNIX socket @event-0YsOG9WSOE; fake /sbin/rsyslogd (earlier systemd-udevd or arpd) inside the ssh.service cgroup; RSA key SHA256:dvACokMYcXJ2om4wuS+TvdtjrAgPK7rC7ZQHDgvBHzk; implant-embedded keys RSA SHA256:KlICz/B59619CpuQdGzgmmvzWBfTMUJ77EwihTYobuo and ED25519 SHA256:OfLY0uF9SwOW9xVjiMXZGDfk6Atmz6CbHy4epknLm8Y; interceptor host key ED25519 SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E.

   Remediation

   • Anyone who accepted an unfamiliar or changed SSH host key over Tor between October 1 and 5 should treat the typed password as stolen, change it, and check the server for Ebury.
   • Relay operators should check Relay Search for unexpected Exit flags or policies, review torrc (ExitRelay, ExitPolicy, ContactInfo, MyFamily, Nickname), NAT rules on port 22, unknown processes, users, authorized_keys, cron jobs and systemd units. A clean host check does not rule out this Ebury.
   • Inspect from a rescue system or offline image if possible; on a live host use key-based login only and start a shell with H=1 I=1 LD_PRELOAD=":" LD_DEBUG=":" bash before running Léveillé's updated script.
   • If compromised: preserve disk and logs, reinstall rather than clean, generate a new relay identity and treat old keys as stolen, rotate all credentials on the host, and report to [email protected].
   • Disable SSH password authentication on internet-facing servers and avoid password reuse.
2. gbhackers.com ↗ · pub. 21/10/2026 05:43 · coletado 21/10 06:00 primeiro registro

   333 Tor exit nodes compromised to intercept SSH sessions, steal passwords and deploy Ebury 1.8.3 backdoor

   ler a análise desta fonte ocultar

   Attackers compromised 333 Tor exit nodes, roughly 10% of the network's ~3,000 exit relays, to intercept SSH connections, harvest passwords and attempt to install the Ebury Linux backdoor. A researcher's account published on October 20, 2026 says the attackers accessed the underlying servers in August and began coordinated interception on October 2. The initial access method is unknown, and no attribution has been made. Tor's network health team assigned the BadExit flag to the relays by October 4, and the identified infected servers were reportedly shut down on October 5.

   Technical Details

   • Compromised relays redirected SSH traffic on TCP port 22 to 12 attacker-controlled interception servers. The operation also targeted unencrypted email traffic, while encrypted web traffic flowed normally.
   • The researcher noticed the attack after a "REMOTE HOST IDENTIFICATION HAS CHANGED" warning showed an unexpected ED25519 fingerprint. Users who ignored the warning and authenticated exposed their passwords.
   • The attackers then connected to the legitimate destination, observed commands through a man-in-the-middle session, and opened a second connection to attempt installation of Ebury 1.8.3, an OpenSSH backdoor and credential stealer.
   • The researcher scanned about 3,000 exit relays individually with exitmap. Around a dozen relays presented fraudulent fingerprints, and more than 300 others forwarded traffic through the same interception infrastructure without substituting fingerprints during testing.
   • Observations from an sshesame honeypot showed the use of Paramiko and an attempted Perl-based Ebury installation. The commands checked the user ID and passwordless sudo, then decoded and executed a Base64 payload.
   • Attackers restarted many relays on October 5, but the BadExit flags limited them to middle-relay roles. They also modified torrc configurations to turn compromised non-exit relays into exit relays.

   Remediation

   • Disable SSH password authentication and use key-based authentication.
   • Never bypass SSH host-key change warnings.
   • Treat Tor relays as highly targeted production systems and harden them accordingly.