Tor Network Purges Hundreds of Compromised Exit Relays

In this episode of CyberInsider, we analyze a significant security breach within the Tor network. Researchers recently identified and removed over 333 compromised exit relays used by malicious actors to hijack SSH connections. This sophisticated campaign relied on intercepting traffic to steal user credentials and deploy the Ebury Linux backdoor on targeted systems. By presenting incorrect host keys to unsuspecting users, attackers successfully positioned themselves as an adversary-in-the-middle, compromising both authentication data and server integrity. The investigation, initiated after a user reported unexpected SSH host key changes, underscores the persistent vulnerabilities inherent in routing encrypted traffic through volunteer-operated infrastructure. While the Tor Project’s rapid response mitigated further damage, the incident highlights a critical industry lesson: application-level encryption and rigorous server authentication remain indispensable, even when using anonymization tools. This breach serves as a stark reminder that users must always verify identity markers before authenticating. For cybersecurity professionals, this event emphasizes the necessity of constant network monitoring and proactive threat hunting to maintain trust within decentralized systems. As attackers evolve their methods to target secure routing protocols, the industry must prioritize heightened vigilance regarding relay reputation and integrity. --- 📰 Read the full article here 🌐 Visit https://cyberinsider.com