Ebury Malware

Definition

Ebury is a long-running Linux SSH server backdoor family used to harvest credentials and maintain persistent access on compromised hosts.

Key Points

• 2026-10: Campaign compromised Tor relay operators via reused passwords; Ebury 1.8.3 deployed on management servers, enabling mass exit-policy hijacks (2026-10-22-tor-exit-nodes-ssh-hijack)
• Uses trojanized libkeyutils and fake rsyslogd collector processes

Related

• tor-project
• application-security
• credential-reuse

Sources

• 2026-10-22-tor-exit-nodes-ssh-hijack