Malicious Actors Compromise 300+ Tor Exit Relays to Intercept SSH Credentials

Attackers compromised over 300 Tor exit relays in early October to intercept SSH traffic and steal login credentials. The malicious activity targeted password-based SSH connections between October 1-5, exploiting Tor's exit nodes for data interception.

Attackers took control of more than 300 Tor exit relays in early October and used them to redirect SSH connections to servers that stole login passwords, a researcher found.

Exit relays are the last hop in a Tor circuit, where traffic leaves the network for its destination. Only a password login to an SSH server made through Tor between October 1 and 5, after accepting the interception

Read original article