Hackers seized 333 Tor exit nodes to steal SSH credentials

On October 2 an attacker took control of 333 Tor exit nodes, about 10% of the network's exit capacity. SSH traffic on port 22 was redirected to 12 interception servers running a paramiko-based MITM attack that harvested credentials and installed the Ebury backdoor.

• 333 Tor exit nodes compromised, roughly 10% of exit capacity
• SSH traffic redirected to 12 interception servers via paramiko
• Attack stole SSH credentials and deployed the Ebury backdoor
• Campaign went undetected due to missing node monitoring