Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections
Over 300 Tor exit relays were hijacked to man-in-the-middle SSH connections and steal passwords—a stark reminder to enforce key-based authentication and never rely on Tor for transport confidentiality.
Summary written by editorial AI · Source link below
Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found.
Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception
Editorial Analysis
The attack exploits a fundamental trust assumption about Tor exit relays, demonstrating that password-based SSH authentication over untrusted networks remains dangerously vulnerable.
Mandate certificate or key-based SSH authentication across all environments and block SSH password login from external or anonymised network sources.
Attackers compromised 300+ Tor nodes to steal SSH passwords, underscoring the need for key-based authentication across the enterprise.
Forward-looking interpretation drafted by editorial AI under human review — not a reproduction of the source. See methodology.
External link — opens at THN (Feedburner) in a new tab.
More from the Threat Intel Desk
- PHP2Shell Exploitation Hits Government Entity Amid Global Scanning and Signs of AI-Assisted Hacking1d
- BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot2d
- Trust Is Not What It Seems — And Fraudsters Are Counting on It3d
- AI Tools Are Generating Massive Attacks for Little Cost3d
- The Good, the Bad and the Ugly in Cybersecurity - Week 43 (2026)3d