Loading malware…
GhostSocks is a Golang-based SOCKS5 backconnect proxy malware offered as a Malware-as-a-Service and closely associated with the Lumma infostealer ecosystem. First publicly observed in 2023 on Russian-language criminal forums and later marketed more broadly, it is designed to convert compromised Windows and Linux systems into residential proxy nodes so operators can route traffic through victim devices and appear to originate from the victim’s network and device context. This capability is used to mask malicious activity, evade IP-based fraud controls, and support follow-on intrusion activity.
GhostSocks commonly appears as a secondary payload alongside commodity stealers such as Lumma and Vidar in fake software installer and trojanized archive campaigns, including lures themed around popular AI tools and developer software. In these operations, a dropper installs both an infostealer and GhostSocks, pairing credential and session theft with proxy access for later abuse.
The malware uses a relay-based command-and-control architecture. Infected hosts register with controller infrastructure, receive relay information, and establish SOCKS5 backconnect tunnels through the victim machine. Newer variants have been observed wrapping relay traffic in TLS, improving stealth and blending with normal encrypted traffic. GhostSocks stores an obfuscated JSON configuration, includes embedded proxy credentials and build metadata, and can receive updated controller information after initial check-in, increasing resilience against infrastructure disruption.
Beyond proxying, GhostSocks exposes backdoor functionality including arbitrary command execution, modification of SOCKS5 credentials, and download-and-execute of additional payloads. Anti-analysis measures reported for the family include sandbox-evasion checks and obfuscation consistent with hardened Go builds. Later Windows variants also added persistence mechanisms, including autorun-based startup persistence.
Operational reporting links GhostSocks strongly to Lumma through automated provisioning and panel integration, suggesting a close commercial or developmental relationship. It has also been reported in broader crimeware ecosystems and has been associated in some reporting with long-term covert access preceding other criminal operations. Its primary value to operators is post-compromise proxy access from legitimate residential or enterprise endpoints, enabling concealment, anti-fraud bypass, and monetization of infected hosts as proxy infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Malware actors were playing a fourth game: opportunistic distribution. Fake repositories dressed as leaked Claude Code delivered Vidar v18.7 and GhostSocks to anyone who downloaded them.
MITRE ATT&CK TTPs ... Resource Development Establish Accounts: Social Media Accounts T1585.003 Disposable GitHub accounts for distribution
For web searches such as “DeepSeek v4 weights GitHub,” the malicious repository and its forks were positioned among top results, at times appearing ahead of official references like the Hugging Face release page.
GhostSocks executes this command with PowerShell, which means defenders should be on the lookout for the above command string as it could be indicative of a GhostSocks infection.
Arbitrary Command Execution ( shell , ID: 5): Executes arbitrary commands sent by the C2: cmd.exe /C <command>
MITRE ATT&CK Mapping Technique Mapping Evidence T1106 Native API Native DLL loaded via Electron FFI.
The above-mentioned GhostSocks sample is heavily obfuscated at points, likely making use of the popular open-source Go obfuscator Garble... Along with some features from Gofuscator such as inline XOR-based string deobfuscation.
MITRE ATT&CK Mapping Technique Mapping Evidence T1036 Masquerading Fake WinDirStat and LightShot apps.
After GhostSocks assembles its JSON configuration dictionary, it encrypts the dictionary with XOR using the key “config” and sends it to one of the C2s contained in its hardcoded C2 list in a basic request... While older samples communicate over HTTP, newer samples have been spotted leveraging HTTPS...
GhostSocks uses a fairly simple relay-based C2 implementation using a simple HTTP API... Upon a victim first connecting to the C2, GhostSocks starts to build the HTTP GET query parameters... and a X-Api-Key header required for all requests to the C2.
MITRE ATT&CK Mapping Technique Mapping Evidence T1090 Proxy Backconnect/proxy strings and yamux-based session code.
MITRE ATT&CK TTPs ... Command and Control Proxy: Multi-hop Proxy T1090.003 GhostSocks SOCKS5 proxy
Download & Execute Arbitrary Executables ( update , ID: 6) Download an arbitrary executable, execute it using the same code used for the shell command
The configuration is then encoded into a JSON object, obfuscated, and written to %APPDATA%\config.
123 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A SOCKS5 proxy malware deployed alongside Vidar that tunnels network traffic through the victim machine, allowing operators to use compromised hosts as residential proxies.
Golang-based SOCKS5 backconnect proxy malware sold as a MaaS offering. It establishes a TCP connection to attacker-controlled relay infrastructure, creates a SOCKS5 tunnel through the infected host, and enables threat actors to route traffic via the victim's IP to bypass geolocation and anti-fraud controls. It also includes backdoor capabilities such as arbitrary command execution, credential modification, and download-and-execute functionality.
Mentioned only as an example of another malware family that uses SOCKS5 traffic.
Additional downstream payload documented in related research as part of the broader fake-AI lure ecosystem alongside Vidar.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.