Researcher kaba said that on Friday, October 2, 333 Tor exit relays began sending SSH connections to 12 attacker-run servers. Exit relays are where Tor traffic leaves for its target. That is roughly 10% of about 3,000. The Hacker News reported the attackers edited relay settings to open port 22, the SSH port. Each server showed a fake host key, a server's identity proof. Only people who accepted it and typed a password were exposed; those who stopped at the warning were not. Kaba said the attackers then logged in to install Ebury, a backdoor hidden in OpenSSH.
The counts differ. The Hacker News cited public Tor directory data showing 377 relays, run by 59 operators, adopted the attacker's settings from October 1 to 4. That analysis calls it a match, not proof of compromise. Nobody knows how the attackers got in; kaba called a hacked hosting company only a theory.
A password travels inside the encrypted session, so whoever ends that session can read it. A key login signs a value unique to each session, so the interceptor could not reuse it, The Hacker News said. Leaders can check whether password login is still on, whether staff stop at host-key warnings, and who uses SSH over Tor.