333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email
Summary
Unknown hackers hijacked more than 300 Tor exit relays to favor unencrypted email traffic and redirect SSH connections to attacker-controlled servers. The intrusion began with reuse of a password to access a Tor management server and deployed the Ebury backdoor to compromise exit nodes, enabling interception of plaintext emails and password collection via SSH. The piece stresses defense-in-depth and recommends disabling password authentication in favor of SSH keys and encrypting email traffic.