Do Son Attackers infected 333 Tor exit nodes with Ebury malware to hijack SSH logins and steal passwords. See how a researcher exposed them.
Ebury malware
Ebury is used to deploy additional malware, including malicious Apache and nginx modules that facilitate web traffic redirection