Security News > 2023 > August > Massive 400,000 proxy botnet built with stealthy malware infections
Researchers have uncovered a massive campaign that delivered proxy server apps to at least 400,000 Windows systems.
Some proxy companies sell access to residential proxies and offer monetary rewards to users who agree to share their bandwidth.
In a report today, AT&T Alien Labs says that the 400,000-node proxy network was built by using malicious payloads that delivered the proxy application.
Despite the company behind the botnet claiming that users gave their consent, the researchers discovered that the proxy installed silently on the devices.
"Although the proxy website claims that its exit nodes come only from users who have been informed and agreed to the use of their device, Alien Labs has evidence that malware writers are installing the proxy silently in infected systems," AT&T Alien Labs.
During the installation of the proxy client, the malware sends specific parameters, which are also relayed to the command and control server so that the new client can be registered and incorporated into the botnet.
News URL
Related news
- TheMoon malware infects 6,000 ASUS routers in 72 hours for proxy service (source)
- TheMoon Botnet Resurfaces, Exploiting EoL Devices to Power Criminal Proxy (source)
- Ebury botnet malware infected 400,000 Linux servers since 2009 (source)
- Ebury Botnet Malware Compromises 400,000 Linux Servers Over Past 14 Years (source)