How hackers infected more than 10% of Tor servers, and how the attack was neutralised.
https://kaba.cx/posts/20261020_Tor/
' The biggest question is still how they got into all those servers in the first place. One theory is that the hosting company itself was hacked (discussed here: lists.torproject.org). But that's just a theory floating around. In truth, no one really knows.
Another is who's behind it. The use of Ebury and the broad collection of unencrypted data point to a financially motivated crime group. Though this too is just speculation.'
leighelse{}
npub1vm…sl5gq
2026-10-20 18:51:12 UTC
Author Public Key
npub1vmtjn35d7r3rlfr4elzagvd5vlxneztrqnq4qgdjsecsz6sd3f2q7sl5gqSeen on
wss://relay.ditto.pubPublished at
2026-10-20 18:51:12 UTCEvent JSON
{
"id": "828d16b7830ee07723013aa6dfb94b9629bb455e4f9b5b894ab7023bd8d0ae8d",
"pubkey": "66d729c68df0e23fa475cfc5d431b467cd3c896304c15021b28671016a0d8a54",
"created_at": 1792522272,
"kind": 1,
"tags": [
[
"content-warning",
"Web forensics"
],
[
"proxy",
"https://mastodon.nz/users/leighelse/statuses/117474739672607050",
"activitypub"
],
[
"client",
"Mostr",
"31990:6be38f8c63df7dbf84db7ec4a6e6fbbd8d19dca3b980efad18585c46f04b26f9:mostr",
"wss://relay.ditto.pub"
]
],
"content": "How hackers infected more than 10% of Tor servers, and how the attack was neutralised.\n\nhttps://kaba.cx/posts/20261020_Tor/\n\n' The biggest question is still how they got into all those servers in the first place. One theory is that the hosting company itself was hacked (discussed here: lists.torproject.org). But that's just a theory floating around. In truth, no one really knows.\n\nAnother is who's behind it. The use of Ebury and the broad collection of unencrypted data point to a financially motivated crime group. Though this too is just speculation.'",
"sig": "392b21e7038f497f842ea9fb3097391caa491db6b49c31d068e09715ed124bbdab388ce7d8c804b66ade7de0b8b6b33b4555dc7272418a4ed5654999c37637ce"
}