The network story in cybersecurity news today is about the last hop. A researcher scanning roughly 3,000 Tor exit relays on October 2 found 333 of them redirecting SSH connections to the same 12 interception servers. Anyone who then logged into their own server over Tor with a password, after accepting the host key the interceptor presented, handed that password over. The interceptor passed the session through to the real server, so nothing looked wrong, and later used the stolen passwords to test sudo rights and plant an installer. The relays were not run by the attacker. Their operators' hosts were compromised by Ebury, a long-running OpenSSH backdoor. The window is closed; the credential question it leaves behind is not.
The arithmetic deserves one plain sentence: at its October 4 peak, the pattern covered 7.46 percent of Tor exit capacity, which for a person administering a server over Tor that week was close to a one-in-thirteen chance per exit of meeting an interceptor. The defense that mattered was not luck. It was whether the login used a key instead of a password.
Tor did what Tor promises: it hid where the connection came from. It cannot vouch for where the connection ends. An exit relay is a stranger's machine by design, and this incident shows what a compromised stranger can do with an SSH session that authenticates by password: keep it, replay it, escalate it. Key-based authentication survived the same interception untouched, because a signature cannot be lifted out of one session and used in another. The other lesson sits one layer down. The relay operators were not careless hobbyists; their hosts carried a backdoor that has survived since 2009, and in the best-documented family a single reused password turned a foothold into root.
Two parts. If your SSH client recorded a host key for a connection made over Tor during the window, paste its SHA256 fingerprint below (it lives in your known_hosts data or the warning you saw). Everything runs in your browser; nothing is sent anywhere.
/usr/lib/x86_64-linux-gnu/libkeyutils.so.1.10.2 owned by no package, the libkeyutils.so.1 symlink pointed at it, the abstract socket @event-0YsOG9WSOE, a fake /sbin/rsyslogd inside the ssh.service cgroup, and any link to 185.225.226.62. Check torrc for ExitPolicy changes and NAT rules on port 22, plus unknown users, keys and cron entries.BreachHunter — Ingenious AI's intrusion and breach-signal hunter — is built for incidents shaped like this one: a quiet redirection, a long dwell time, and a second stage that arrives after the first event looks harmless. Get early access on WhatsApp.
1. How many exit relays did the researcher's scan find redirecting SSH?
2. What could the interceptors capture?
3. What was the root cause on the relay operators' hosts?
4. When did the exposure window close?
5. What does the 377-relay figure actually count?
The Tor SSH interception case is the October 2026 discovery that hundreds of Tor exit relays had been quietly redirecting SSH connections to a set of interception servers. Anyone who logged into a server over Tor with a password, after accepting the interceptor's host key, could have that password captured and reused. The relays' own hosts were compromised by the Ebury OpenSSH backdoor; the Tor Project removed the relays from the network by October 5.
No, and the reason is structural. SSH key authentication proves identity with a signature bound to that specific session, so an interceptor sitting between you and the server cannot replay it to the real server. Password authentication has no such binding: type the password into the wrong endpoint and the interceptor owns it. That is why the exposure test for this incident is Tor plus password plus an accepted host key, and why moving servers to key-only login removes this whole class of attack.
For a session: compare the fingerprint of the host key your SSH client recorded for connections made over Tor between October 1 and 5 against the published interceptor fingerprint, SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E. It is one of possibly several interceptor keys, so a match is proof and a non-match is not clearance. For a relay or server host: look for the Ebury signs listed on this page, including the setuid libkeyutils file no package owns and the fake rsyslogd process. A clean host check does not rule Ebury out.
Check your torrc for ExitPolicy or ExitRelay changes you did not make, look for NAT rules touching port 22, and audit for unknown processes, users, SSH keys and cron entries. Then check the Ebury artifacts: a setuid libkeyutils.so.1.10.2 owned by no package, the library symlink pointed at it, the abstract socket named in the research, and connections involving 185.225.226.62. If the host is compromised, take it offline, preserve the disk and logs, reinstall from clean media, start a new relay identity, and rotate every credential the host ever held.
Nobody can tell you from a list, because no victim count exists. Run the three-part test instead: did you connect to a server by SSH over Tor between October 1 and 5, did that login use a password, and did you accept a host key during it? If all three are true, treat the password as captured and rotate it from a clean machine over a normal connection, whether or not the one published fingerprint matches. If you used key-based authentication, the interception could not relay your login.
Sources: The Hacker News, October 2026, reporting researcher kaba's scan and directory-data analysis (333 relays, 12 interception servers, 377 policy-matching relays, the 7.46 percent peak, the Ebury root cause, the October 4–5 Tor Project response, and the published interceptor fingerprint), with Ebury history from ESET's long-running research as cited there.