AI Weekly Malaysia

On Friday 2 October at 09:35, 333 compromised Tor exit relays — roughly 10% of Tor's ~3000 exit relays — began a coordinated campaign to intercept SSH connections on port 22 and harvest unencrypted mail traffic. The servers had been breached two months earlier in August with an Ebury 1.8.3 payload (an OpenSSH backdoor and Linux credential stealer), and SSH sessions were silently redirected to one of 12 interception servers, which stole passwords, watched commands, and reinfected the connecting server. The author reported it to the Tor Project's network health team that evening; relays were marked BadExit on Sunday 4 October, and by Monday 5 October the attackers' restarted relays could only serve as middle relays before all infected servers were shut down.

Why: The concrete lesson is that the SSH "REMOTE HOST IDENTIFICATION HAS CHANGED" prompt is not a formality — in this campaign, accepting it handed over your password and pushed Ebury onto your own box. If any of your tooling or CI connects over Tor, or if you have StrictHostKeyChecking disabled or set to accept-new in scripts, you would have sailed straight through this without seeing the warning at all. Decide now how your team handles a changed host key: verify the fingerprint out-of-band (the intercepted ED25519 key here was SHA256:6baCZCPsl+AfQuujUS81fMEE/C7UeJ+AwjrImqmDB3E) rather than clicking yes.

The Hacker News reports that Rank Math PRO, a widely installed WordPress SEO plugin, was "hijacked to deliver a self-restoring backdoor." The supplied text is only the headline plus site boilerplate — it cuts off before any affected version numbers, distribution mechanism (update server vs. nulled/bundled copy), indicators of compromise, or vendor response. Treat the specifics as unconfirmed until the full article or Rank Math's own advisory is read.

Why: If you run client or company sites on WordPress with Rank Math PRO, the descriptor "self-restoring" implies the backdoor likely re-establishes itself, so the usual fix — delete the plugin folder, reinstall from wordpress.org, done — is probably not sufficient remediation. Until the article gives affected versions and IOCs, the practical move is to pull a file-integrity baseline of wp-content/plugins/rank-math and compare against a known-clean copy, and to check whether the site pulls plugin updates from anywhere other than the official channel. Do not treat this as actionable for your stack beyond that until version details exist.