A malicious campaign that redirected SSH connections and targeted unencrypted email traffic reminds us that masking traffic’s origin is not the same as securing what happens once it leaves an anonymity network.
For three days in October, attackers maintained control of hundreds of Tor exit relays. They used these relays in an interception campaign targeting SSH connections and unencrypted email. Researchers identified 333 affected exit relays, but investigators still don’t know how the attackers first gained control of all the underlying servers.
Let’s take a moment to explain what Tor is and why these exit relays matter. Tor, short for The Onion Router, is an anonymity network that routes internet traffic through multiple, layered relays, obscuring the origin of a user’s connection.
An exit relay is the final hop in that path, forwarding traffic out of Tor and toward its intended website or service. The Tor Project describes exit relays as volunteer-maintained infrastructure that enables users to leave the Tor network and access websites and other online services.
Think of these relays as a chain of independent taxi drivers you use in succession. Each taxi only knows where it picked you up and where to take you next. The final taxi, the exit relay, carries you to your final destination but doesn’t reveal where your journey began. This means the exit relay is a critical boundary, where Tor traffic leaves the network and enters the public internet.
Tor can help conceal the origin of traffic, but the security of the connection as it leaves the network remains important. This incident, involving 333 compromised exit relays, highlights an important distinction in the realm of cybersecurity: anonymity and security are related, but they are not interchangeable.
Would your team catch the next zero-day in time?
Join security leaders who rely on the Think Newsletter for curated news on AI, cybersecurity, data and automation. Learn fast from expert tutorials and explainers—delivered directly to your inbox twice weekly. See the IBM Privacy Statement.
This recent campaign illustrates why the final relay hop deserves more attention.
According to Ars Technica, the compromise began in late August when an attacker used a valid, reused password to access a Tor management server and install the Ebury Linux backdoor. The attacker then accessed another server using an RSA key that investigators could not find among that server’s authorized keys. From October 2 through October 5, compromised exits redirected SSH traffic to 12 attacker-controlled interception servers and altered email handling in a way that favored unencrypted traffic. SSH, or Secure Shell, is a protocol for securely connecting to another computer and managing it over a network. The protocol encrypts the connection, including login credentials and commands.
To be clear, the attack did not make encrypted web traffic suddenly readable. Ars Technica that encrypted web traffic continued to be forwarded normally. For SSH, the interception server presented a different host key. This means users who ignored the resulting changed-key warning and entered their passwords could expose those credentials.
This matters because after an incident like this, the immediate reaction is to label Tor as unsafe. Security experts on a recent episode of the Security Intelligence podcast were certainly skeptical of the network, but their discussion illuminated the more complicated reality around using Tor.
“I’ve just assumed that every Tor exit node is compromised from the get-go,” Nick Bradley, Manager of X-Force Threat Intelligence at IBM, said during the discussion. However, that skepticism does not mean anonymity is inherently malicious.
Don Cowan, an IBM X-Force Red Associate Hacker, agreed with much of the panel’s criticism of Tor, but pointed out that using it to avoid censorship is one legitimate reason someone might seek anonymity. Even if circumventing those restrictions violates local laws, Cowan argued, “I wouldn’t say [that] is necessarily immediately nefarious.”
This is not the first time exit relays have been compromised. In 2020, the Tor Project removed malicious exit relays that interfered with traffic to cryptocurrency exchanges. At the time, they warned that unencrypted HTTP requests remained vulnerable to attack.
What is notable about the most recent hijacking is that the project is now also considering structural friction for new exit nodes. Tor Project’s 2026 exit-relay lifecycle proposal specifically cites previous man-in-the-middle attacks and states that the staging period is designed to increase attackers’ costs and provide an opportunity for earlier detection.
The Tor Project’s guidance on relay types underscores why exit relays require particular care. Destination services see the exit relay’s IP address rather than the user’s, which can create legal and operational exposure for relay operators. That does not make Tor itself untrustworthy but instead reinforces the need to secure and monitor the boundary where traffic leaves the anonymity network.
The practical takeaway from this incident is broader than just Tor. Anonymity infrastructure can obscure origin information without making every system beyond that boundary trustworthy. The October attack reportedly began with something considerably less exotic: a reused password.
For security teams, that may be the most important lesson to pass along. Privacy technology does not replace the basic fundamentals of security, and sophisticated architecture can still be undermined by classic failures in credential and infrastructure security.
