Attackers Hijacked Over 300 Tor Exit Relays to Intercept SSH Connections

Attackers compromised over 300 Tor exit relays in early October, using them to intercept SSH connections. The hijacked relays redirected SSH connections to servers designed to steal login passwords. This interception occurred when a user logged in to an SSH server through Tor using a password between October 1 and 5. The attackers targeted the last hop in a Tor circuit, where traffic exits the network. The compromise allowed attackers to steal passwords from users who made SSH connections through the affected relays during this time. The attack relied on users accepting the interception to succeed.