Executive Summary
In early October 2026, the Ebury botnet (version 1.8.3) successfully hijacked 377 Tor exit relays, representing approximately 7.46% of the network's exit capacity. The primary objective was a large-scale Man-in-the-Middle (MitM) attack targeting SSH connections. By rewriting the 'torrc' configuration files, attackers enabled SSH (port 22) on relays that previously blocked it and redirected this traffic to malicious interception servers designed to harvest plaintext credentials.
Technical analysis reveals the compromise heavily affected the Quetzalcoatl relay family and operators hosted on FranTech (BuyVM) and Contabo. The Ebury malware persists as a userland rootkit that hooks OpenSSH to steal credentials and can even survive reboots by infecting system libraries. While the Tor Project has since removed these malicious relays from the consensus, the incident highlights a significant supply-chain or hosting-level vulnerability among Linux-based relay infrastructure.
The business and security impact is high for users who accessed SSH servers via Tor during the October 1-5 window. Any password-based login performed through an intercepted relay resulted in credential theft and subsequent potential infection of the target server via automated Perl-based installers. The incident underscores the risk of password reuse and the critical need for key-based SSH authentication.