PROXYLIB

Proxylib is a botnet associated with residential proxy abuse. It has been reported infecting large numbers of internet-connected devices and integrating those compromised systems into proxy infrastructure linked in reporting to the Asocks ecosystem. Observed victim devices have included consumer and mobile endpoints, and the operation has also been tied to a discontinued VPN service and multiple Android applications, indicating a distribution model that leveraged software and mobile app ecosystems to build proxy capacity. The actor’s core capability is converting compromised devices into proxy nodes that relay third-party traffic through residential or consumer IP space, enabling downstream malicious activity to appear as legitimate user traffic. Residential proxy infrastructure of this kind is commonly used to support cybercrime operations including distributed denial-of-service activity, phishing, credential theft, brute-force attacks, malware distribution, and related abuse. High-confidence reporting specifically links Proxylib to large-scale device compromise and operation of proxy-network infrastructure, but does not establish the full set of follow-on operations directly conducted by the same actor. Proxylib is best characterized as a cybercriminal botnet operation focused on initial compromise of devices and their subsequent use as proxy infrastructure. Publicly available information in this context does not support a confident attribution to a nation state, a specific country of origin, or a defined set of country or sector targets.