Unknown Entity Hijacks More Than 300 Tor Exit Nodes and Deploys Ebury
· 1:13 · Watch on YouTube ↗
Summary
An unknown entity reportedly hijacked more than 300 Tor exit nodes after using a reused password to access a management server. The nodes were reconfigured to favor unencrypted email traffic and redirect SSH connections; Ebury was installed.
Key points
- More than 300 Tor exit nodes were reportedly hijacked and reconfigured to favor unencrypted email traffic and redirect SSH connections through servers controlled by the unknown entity.
- The attackers reportedly gained access to a Tor management server using a valid reused password.
- Ebury, identified in the transcript as a Linux backdoor Trojan, was installed and could capture SSH passwords and monitor typed commands.
- The video cautions that Tor is designed to disguise where connections originate, not to provide complete security.