Executive Summary
In early October 2026, threat actors utilized the Ebury botnet to compromise over 300 Tor exit relays, representing roughly 7.5% of the network's exit capacity. The attackers modified relay configurations to allow SSH (port 22) traffic and redirected these connections to interception servers. This campaign aimed to capture SSH password credentials via Man-in-the-Middle (MitM) tactics, which were subsequently used to install the Ebury backdoor on the victim's destination servers.
The attack chain involved gaining root access on Linux-based relay hosts, often via credential reuse or potential hosting provider compromise, followed by the deployment of Ebury version 1.8.3. This version is a sophisticated userland rootkit that hides within OpenSSH and captures plaintext passwords during authentication. The Tor Project has since mitigated the threat by flagging affected relays as 'BadExit,' but the scale of the compromise highlights the persistent threat posed by the Ebury botnet, which has infected over 400,000 servers since 2009.
This incident is critical for organizations using Tor for administrative access and for Linux server administrators. The reliance on password authentication and reused credentials facilitated the initial breach, emphasizing the urgent need for SSH key-based authentication and hardware security modules for relay master keys.