Ebury
AssessTools
A Linux OpenSSH backdoor and credential-stealing malware used to gain persistent access.
Why it's here
Placed in Assess: 1 article(s) of evidence from 1 source(s), led by security coverage, with 1 in the last 30 days. Confidence 24%. Low accumulated evidence, so it defaults conservatively pending more signal.
Evidence (1)
- 8Hacker News·10/20/2026securityOver 300 Tor exit nodes used in SSH interception campaign shut down
A coordinated attack compromised 333 Tor exit relays and redirected SSH connections through interception servers to steal passwords and observe logins. The Tor Project’s network health team and relay operators responded by marking the relays BadExit and shutting the infected servers down.