In October 2026, attackers hijacked 333 Tor exit relays and redirected SSH connections through infrastructure they controlled. The campaign followed an earlier compromise involving a reused password and the Ebury Linux backdoor. Some relay configurations also favored unencrypted email traffic.
Tor helps obscure the origin of network connections, but it cannot guarantee that every exit relay is trustworthy or protect credentials entered into an intercepted SSH session. Encryption, host-key verification, and strong authentication remain essential. The incident also illustrates how a single compromised management server can affect infrastructure used by many people.
How should organizations balance anonymity, secure authentication, and trust in the infrastructure carrying their traffic?
Subscribe to our podcasts: https://securityweekly.com/subscribe
#Tor #NetworkSecurity #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec
Tor helps obscure the origin of network connections, but it cannot guarantee that every exit relay is trustworthy or protect credentials entered into an intercepted SSH session. Encryption, host-key verification, and strong authentication remain essential. The incident also illustrates how a single compromised management server can affect infrastructure used by many people.
How should organizations balance anonymity, secure authentication, and trust in the infrastructure carrying their traffic?
Subscribe to our podcasts: https://securityweekly.com/subscribe
#Tor #NetworkSecurity #SecurityWeekly #Cybersecurity #InformationSecurity #AI #InfoSec