Attackers Compromise 10% of Global Tor Exit Nodes
The breach involves the theft of SSH credentials and the deployment of the persistent Ebury Linux backdoor.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you still trust anonymous internet routing tools to keep your private data secure?
Attackers have compromised 333 Tor exit nodes, enabling them to steal SSH credentials and install the Ebury Linux backdoor. These affected relays represent roughly 10% of the entire Tor network infrastructure.
Why it matters
The compromise of a significant portion of Tor exit traffic poses a major security threat, as it allows attackers to intercept sensitive authentication data and persist within server environments. This event highlights a critical vulnerability in the trust model of anonymous network infrastructure.
The breach compromised 333 nodes out of 3,000 total relays, representing 10% of the network capacity. Attackers exploited these nodes to intercept traffic and deploy the Ebury Linux backdoor, a persistent malware strain that infects server systems.
The players
Tor Network
An open-source software project that enables anonymous communication by routing internet traffic through a global volunteer overlay network.
Ebury
A sophisticated Linux backdoor that creates a persistent, stealthy entry point for unauthorized server access.
The details
Attackers gained control by compromising the underlying servers of the Tor exit nodes. By intercepting SSH—Secure Shell, a protocol used to remotely manage servers—connections passing through these nodes, the actors were able to harvest credentials. These credentials provided the access necessary to deploy the Ebury Linux backdoor, a malicious software tool designed to maintain unauthorized, persistent access to compromised Linux operating systems.
Timeline
October 20, 2026: Researchers published an account detailing the compromise.
The Tech Race
This attack marks a significant departure from the trust-based model of the Tor network, which relies on the security of individual relay operators. It demonstrates that the infrastructure's anonymity protections are only as robust as the underlying server security of its volunteer nodes.
Users of the Tor network are at immediate risk of having their SSH traffic intercepted if routed through one of the compromised exit nodes. It is highly recommended that operators of Tor relays inspect their servers for the Ebury backdoor and rotate all SSH keys.
The takeaway
This breach highlights the need for stricter security auditing of infrastructure that facilitates anonymous routing. Watch for future updates from security researchers regarding the potential identification of further compromised nodes or indicators of compromise linked to Ebury.
Further reading
For broader context on network-level threats, visit the Cybersecurity section.
Live Poll
Do you still trust anonymous internet routing tools to keep your private data secure?
