You open a terminal and type ssh user@server through Tor. You expect the exit relay to be a simple last hop that dumps your encrypted packets onto the open internet. For three days in early October, on 333 of those exits, that assumption was wrong. Tor has roughly 3,000 exit relays. The attacker controlled about 10% of them. Those relays were reconfigured so that any SSH connection on port 22 was silently redirected to one of 12 interception servers the attacker operated. The exit no longer forwarded the connection to the real server. It completed the TCP handshake itself and presented its own SSH host key. If you ignored the “REMOTE HOST IDENTIFICATION HAS CHANGED” warning and typed your password anyway, the interceptor captured the password, watched every command you typed, and then opened a second connection to the real server to try to install Ebury 1.8.3 (an old OpenSSH backdoor and credential stealer). The researcher who discovered this used exitmap to scan the exits and a honeypot to confirm the interception servers were speaking Paramiko. At the same time the exits were altered to block the common encrypted mail ports (25, 465, 587, 993, 995) while still allowing the unencrypted ones. The goal was to force or capture plaintext email traffic as it left the Tor network. The initial foothold appears to have come from a reused password on a management server in late August, after which Ebury was installed and the configuration changes were pushed. The Tor Network Health team began flagging the relays BadExit on 4 October; by 5 October the malicious exits were gone from the consensus. The interesting part is not that someone ran a bad exit. It is that the attacker turned ordinary Linux hosts into exits by editing their torrc files and then used the exit position itself as the man-in-the-middle point. The cryptography of the circuit still protected you from the middle relays. The moment your traffic left the network, the exit could see (and modify) the cleartext stream if the application protocol allowed it. Treating “I am using Tor” as a single security property. Exit-node compromise shows it is actually two: the circuit hides you from the destination, and the exit is assumed not to be actively hostile to the specific protocol you are speaking. For three days, roughly one in ten exits violated the second assumption for SSH and email. Host-key verification and key-based authentication stop the SSH half. The email half is harder; once the exit is the one talking to the mail server, encrypted ports can simply be dropped. The practical reminder is the same one that keeps appearing in physical-layer attacks: the model assumes the last device or the last hop behaves the way the protocol designer expected. When it does not, the higher-layer protections never get the chance to run.