The attack on SSH seems rather poorly conceived. Not only was it detected immediately thanks to SSH printing that huge banner on MITM attacks, but it allowed the admins to easily trace every infected node and respond quickly to shut the whole operation down. Had they stuck to email they would still be running today.
> Not only was it detected immediately thanks to SSH printing that huge banner on MITM attacks
The thing is, that only helps Tor users who are happy for their PC to contain evidence of what they were doing over Tor (such as a known hosts file listing).
If your security requirements are so high your PC contains no evidence whatsoever of what you were doing over Tor, you wouldn't get the banner.
That’s actually a really good point, I remember from the Darknet Diaries podcasts that this is typically how darkweb operators manage their things, not using any storage and starting from a fresh machine every boot.