Loading malware…
9 distinct techniques documented for this family, organized by ATT&CK tactic.
Proxice obtains an encrypted Base64+XOR C2 list from ENS, using XOR key 0x0000000067615613.
Observed Proxice traffic consisted predominantly of requests to login.live.com:443, described as an automated credential-stuffing campaign against Microsoft.
Netway traffic accessed local Linksys router administration interfaces and DOCSIS modem pages without RFC1918 filtering; Proxice permits direct access to 127.0.0.1:5555 and 192.168.x.x addresses.
Netway integrates 3proxy and uses a reverse 3proxy tunnel (-r 79.127.248.199:10975) to traverse NAT and firewalls; the infrastructure mapped more than 60,000 unique residential IPs.
Proxice variants use a TCP control plane on port 9999, a QUIC data plane, and an earlier custom UDP ARQ transport.
Maskify resolves C2 through ENS plus IPFS and updates automatically through ENS; Proxice also resolves its encrypted endpoint list through ENS.
The Proxice loader downloads dynamically signed DEX payloads; Mirai downloads an ARM32 ELF; Maskify fetches an APK containing libkys.so.
Proxice resolves C2 through the ENS domain dortation.eth and rotates five public Ethereum RPC endpoints; Maskify also uses ENS-based C2 resolution.
Netway and Proxice turn SuperBox devices into non-consensual residential proxy nodes; traffic is sent from victims' residential IP addresses.
5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.