Attackers Compromise 333 Tor Exit Nodes
A massive cyberattack has targeted roughly 10% of the Tor network's exit relays to deploy malware.
Updated on Oct. 21, 2026 in Cybersecurity
Live Poll
Do you still trust anonymous internet routing tools to keep your private data secure?
Attackers have compromised 333 Tor exit nodes, representing approximately 10% of the entire network. The campaign involves intercepting SSH connections to steal credentials and deploy the Ebury Linux backdoor.
Why it matters
By infiltrating these nodes, attackers gain a window into encrypted traffic and server access. This breach highlights significant vulnerabilities in the infrastructure that users rely on for anonymity.
The compromised exit relays account for approximately 10% of the 3,000 nodes operating on the Tor network. Attackers utilized these nodes to target underlying servers and install the Ebury Linux backdoor.
The players
Tor Project
The Tor Project is a non-profit organization that manages the Tor network, a system designed to enable anonymous communication by routing traffic through a worldwide network of relays.
The details
The malicious campaign allows attackers to intercept SSH connections through the compromised exit nodes, granting them unauthorized access to server infrastructure. Once access is gained, they deploy the Ebury Linux backdoor to maintain control.
Timeline
October 20, 2026: Research detailing the compromise is published.
The Tech Race
The use of the Ebury Linux backdoor to hijack Tor infrastructure follows a documented trend of increasingly sophisticated attacks against anonymity-focused server environments. This event highlights how legacy backdoor software continues to be repurposed by attackers to target critical infrastructure.
Users relying on Tor for anonymity may have had their traffic and credentials exposed during the period these nodes were compromised. Those managing servers through Tor should update security protocols and review systems for signs of the Ebury backdoor.
The takeaway
Users should be aware that exit nodes are potential points of failure that can compromise their privacy. Implementing end-to-end encryption remains essential even when utilizing anonymization tools to protect sensitive credentials.
Further reading
For more on evolving digital threats, visit the Cybersecurity section.
Live Poll
Do you still trust anonymous internet routing tools to keep your private data secure?
