tl;dr: A researcher discovered that ~333 Tor exit nodes (roughly 10% of the network) had been compromised with the Ebury OpenSSH backdoor and were coordinating to intercept unencrypted mail traffic and MITM SSH connections on port 22. Using exitmap to script test SSH connections between two of his own servers, he detected which exits were redirecting traffic to 12 interception servers, then reported findings to the Tor Project, which flagged the relays as BadExit within days. The origin of the initial server compromise remains unknown, with speculation pointing to a possible hosting provider breach.