- Engineer — Plan: Only password-based SSH sessions routed through Tor during October 1-5 are affected. Audit SSH access logs for Tor-origin connections in that window, rotate any credentials that may have been exposed, and enforce key-only SSH authentication on all servers.
- SOC/IR — Plan: The active interception window closed October 5; build a hunt for any Tor-exit-routed SSH sessions in that period and trace subsequent authentication events from potentially stolen credentials to detect follow-on access.
- Leader — Skip