G3Proxy

G3Proxy is a malicious residential proxy botnet and proxy service associated with the broader ecosystem of criminal proxy networks built from compromised consumer devices. It initially spread through preinfected Android TV boxes and later expanded through Android APK-based infections in 2026. At peak scale, it exceeded 1 million victim IP addresses per day, making it one of the larger botnet-backed proxy services observed in this ecosystem. The operation monetizes access to infected devices by routing third-party traffic through victim residential connections, a model commonly used to support anonymity, fraud enablement, and other downstream criminal activity. G3Proxy is part of a resilient supply chain in which operators may both maintain their own botnets and participate in proxy resale relationships with other services. Following disruption activity against IPIDEA, G3Proxy shifted its command-and-control infrastructure into Chinese IP space, aligning it with a broader cluster of proxy botnets assessed to be operated by Chinese actors. These services have been noted for systematically excluding mainland China from their proxy pools. Known tactics and behaviors directly associated with G3Proxy include initial access through supply-chain-style device compromise and malicious Android application distribution, persistence on infected Android-based devices, command-and-control operation for proxy enablement, and post-compromise use of victim systems as externally accessible proxy nodes. Its dominant motivation is financial, centered on selling or brokering access to compromised residential connectivity.