Technology Switzerland

333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email

Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers…

By The News Engine Desk Based on reporting by Ars Technica

22 Oct 2026, 17:00 IST 1 min read 0 views

Image accompanying the story: 333 Tor exit nodes hijacked to intercept SSH traffic and retrieve plaintext email — Image: Photo Illustration by Pavlo Gonchar/SOPA Images/LightRocket via Getty Images · via Ars Technica

Ars Technica reports: Unknown hackers hijacked more than 300 Tor exit nodes and reconfigured them to favor unencrypted email traffic and redirect SSH connections through servers they controlled, a researcher reported Tuesday.

The hijacking began in late August, when according to Tor volunteers, the attacker used a valid password that had been reused to gain access to a Tor management server. The attacker then installed Ebury, a backdoor written for Linux that was discovered 12 years ago.

This technology story centres on Switzerland. Names and organisations mentioned in the coverage include Tor, SSH and Ebury.

Why it matters

Changes in the tech sector often reach consumers quickly through the devices, apps and online services they use every day.

Key details

Location: Switzerland · Europe
Reported by: Ars Technica
First reported: 22 Oct 2026, 17:00 IST
Key names: Tor, SSH, Ebury, Linux
Section: Technology
Figure cited: Mysteries remain Then the attacker connected from the management server to a second Tor server, called Switzerland2… (Ars Technica)