# How I got over 300 Tor exit nodes removed

> 333 infected Tor exit nodes shut down after SSH attack.
- Title: How I got over 300 Tor exit nodes removed · Kaba | Shortify
- Summary: 333 infected Tor exit nodes shut down after SSH attack. 333 infected Tor exit nodes were shut down after attackers intercepted SSH connections and stole…
- Keywords: tor, ssh, exit nodes, security breach, malware, ebury, tor project, technology, startups, got, 300, exit
- Source: Kaba — https://kaba.cx/posts/20261020_Tor
- Published: 2026-10-20T00:00:00+00:00
- Read time: 1 min
- Topics: tor, ssh, exit nodes, security breach, malware, ebury, tor project, technology, startups
## Attack starts
On Friday Oct 2, 2026, 333 infected Tor exit nodes started intercepting SSH connections.
## Scale of attack
All of Tor has around 3000 exit relays, so roughly 10% were under their control.
## How they gained access
The attackers gained access two months earlier in August and deployed Ebury 1.8.3 payload.
## SSH interception method
Infected nodes block ports to handle only unencrypted mail traffic and redirect SSH connections.
## My SSH connection
My SSH connection got redirected to an interception server with a warning about host identification change.
## What attackers do
Attackers steal passwords, observe commands, and infect servers with Ebury.
## Response timeline
Tor health team contacted operators on Friday evening, marking nodes as BadExit by Sunday.
## Nodes shut down
All infected servers were shut down by Monday, with some relays remaining as middle relays.
## Technical details
I used exitmap to find infected nodes by checking SSH fingerprints and redirection patterns.
## Key takeaway

333 infected Tor exit nodes were shut down after attackers intercepted SSH connections and stole credentials.