Hackers Hijack 333 Tor Nodes, Steal Data

In late August, a significant cybersecurity incident saw 333 Tor exit nodes hijacked by unknown attackers. The malicious actors gained access to a Tor management server and a server named Switzerland2, ultimately reconfiguring two of its hosted exit nodes. This allowed them to redirect SSH traffic through 12 interceptor servers they controlled.

Furthermore, the compromised nodes blocked specific ports essential for encrypted email while allowing unencrypted traffic. This measure aimed to capture unencrypted messages if email services downgraded connections. The attackers also employed the Ebury backdoor, a known Linux-based malware discovered 12 years prior, to facilitate their data theft operations.