SwitzerlandAttackers hijacked 333 Tor exit nodes for 3 days.
Tor hides who you are, not what you send, so unencrypted traffic leaving it is exposed.
Attackers blocked encrypted email ports to force plaintext downgrades and sent remote-login traffic on port 22 to 12 interception servers.
Tor volunteers suspect a financially motivated crime group but call that speculation.
They still do not know how the attackers reached so many servers.
How each outlet framed it
- Ars Technica leans critical
- details the Ebury backdoor installed on Switzerland2 and the 12 interceptor servers that redirected SSH traffic
Sources: Ars Technica