Mylobot

Mylobot is a long-running Windows malware family and botnet best known for converting infected systems into backconnect proxy nodes while also maintaining downloader functionality for additional payload delivery. Public reporting has tracked the family since 2018, with evidence that its core loader architecture predates that disclosure and remained active for years afterward at substantial scale.

The malware ecosystem includes multiple components, notably a proxy-focused bot and a downloader component often referred to as mylobot-core, both commonly delivered through a shared packer and shellcode-based loader. That loader resolves Windows APIs dynamically, decrypts embedded resources, and launches later stages through process hollowing into a newly created host process. The downloader stage performs anti-virtual-machine checks, contacts encrypted command-and-control infrastructure, reports basic host information, and retrieves subsequent payloads, most commonly another Mylobot component.

Mylobot’s primary operational role is proxy enablement. Infected hosts can be instructed to relay traffic, maintain persistent command-and-control sessions, and service remote connection tasks, effectively turning victim machines into residential-style proxy infrastructure. Telemetry and infrastructure analysis have repeatedly linked the botnet to the BHProxies proxy service, supporting the assessment that monetization through proxy access is a central purpose of the operation. Researchers have also observed commands for downloading and executing additional binaries, mainly for self-update and component refresh, though Mylobot has at times been associated with delivery of other malware.

Network behavior associated with Mylobot includes extensive domain discovery activity, including large volumes of DNS requests to hardcoded or algorithmically varied subdomains, followed by persistent command-and-control connectivity once a live server is found. Some variants used fake-DGA-style domain lists, while later proxy-focused versions reduced or changed that approach. The downloader component has continued to use encrypted hardcoded domain sets and runtime decryption to locate next-stage infrastructure.

Mylobot targets Windows systems and has been observed globally at significant infection volume. Reporting has identified especially high victim concentrations in countries including India, the United States, Indonesia, and Iran during some observation periods. The malware is primarily associated with cybercriminal monetization through proxy services, although isolated observations indicate the operators may also have experimented with adjacent criminal activity such as spam or extortion-related tooling.