Unknown attackers took control of more than 300 Tor exit relays in early October, according to Ars Technica and The Hacker News. They used them to try to steal passwords and email.

Exit relays are the last stop in a Tor connection, where traffic leaves the network for its goal, The Hacker News said.

A researcher who goes by kaba found 333 exit relays sending SSH logins to the same 12 servers run by the attackers, Ars Technica and The Hacker News reported. SSH is a common tool for logging in to remote computers.

When a user connected, the attacker's server showed its own key, the outlets reported. Users who ignored the warning that the key had changed and typed in a password could have had it stolen, the outlets said.

The attackers also closed ports used for encrypted email on the relays, Ars Technica and The Hacker News reported. That left only ports that can carry plain, readable email. It is not clear whether the attackers read any messages, Ars Technica said.

At its peak on October 4, the affected relays carried 7.46% of Tor's exit traffic, The Hacker News reported. The Tor Project began flagging the relays that day, and by October 5 none were left in use, the outlet said.

The attack began in late August, when someone used a reused password to get into a Tor management server, Ars Technica reported. The attacker then installed Ebury, a known Linux backdoor, the outlets said.

It is still not known who is behind the attack, the outlets reported. Investigators also have not found out how the attackers got into all of the servers, Ars Technica said.

The Tor Project has asked relay operators to check their settings and to reinstall any server that was hit, The Hacker News reported.

What we know: More than 300 Tor exit relays were hijacked in early October to steal SSH passwords.
What we don't: Who did it, and how many passwords or emails were taken.