How I got over 300 Tor exit nodes removed
Summary
The post details a coordinated campaign that infected over 300 Tor exit nodes to intercept SSH and exfiltrate data, using an OpenSSH backdoor (Ebury). It documents how Tor operators identified and shut down the compromised relays and notes a dip in exit node availability. Practical takeaways emphasize hardening SSH, using key-based authentication, and treating relay machines as highly targeted production systems.