All about that proxy. [Research Saturday]

The episode opens with a discussion on the rise of malicious residential proxy operations, particularly focusing on a threat actor dubbed 'Lurking Lizard'. This actor has been active since at least 2022, employing fake software installers, VPNs, and lookalike domains to covertly convert unsuspecting victims’ devices into proxy nodes. The investigation uncovered over 230 related domains that operate as part of this ecosystem, interconnected through shared infrastructure, tracking URLs, and deployment patterns. The actor’s method involves recruiting devices—often without explicit user knowledge—and monetizing their bandwidth via proxy services and associated fake review sites.

The research highlights the importance of DNS analysis in tracking the actor’s operations, revealing how multiple domains—seemingly separate—are actually controlled by the same entity. The team examined domain registration details, IP addresses, timing, and branding similarities. They found that domains like 7zip.com, despite resembling the legitimate 7-Zip, were malicious. The investigation uncovered that the actor was using lookalike domains and hijacked popular utilities to distribute malware, including fake installers and VPN apps such as WireVPN. The use of IP logger URLs embedded in malware was a key technique for tracking threat actor activity.

The episode explains that the actor runs an end-to-end proxy business, sourcing compromised devices (including smart TVs, phones, and laptops) to form a network of proxy nodes. These nodes are then sold or used to facilitate activities like illegal streaming or credential stuffing. The actor’s operation includes multiple pillars: distributing malware and utilities, recruiting devices, and selling access to the proxies. This model mirrors traffic arbitrage strategies seen in Eastern European cybercrime, but it is unusual in the residential proxy space, reflecting a highly integrated and controlled approach from victim recruitment to monetization.

The research emphasizes the risks of typosquatting and lookalike domains as vectors for infection. It underscores the importance for organizations to verify sources when downloading utilities and to enforce policies against the use of free VPNs and suspicious software. The episode advises awareness of the fact that many so-called 'residential proxies' may actually belong to malicious operators exploiting devices without user consent. Techniques like DNS analysis, domain tracking, and monitoring search engine typos are critical for defenders to identify and mitigate these threats.

The episode concludes with reflections on the sophistication and scale of the actor’s operation, noting its similarities to traffic arbitrage models in ad tech. It highlights the importance for security professionals to understand the interconnected nature of these malicious campaigns and to recognize that the threat actors control nearly every stage—from attraction and infection to monetization. The overall message encourages vigilance, rigorous source verification, and robust policies against unauthorized VPNs and proxy usage in enterprise environments.