Loading malware…
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Netway persistence mechanisms: boot receiver, network change receiver, ProcessPhoenix, JobScheduler with setPersisted(true).
Netway persistence mechanisms: boot receiver, network change receiver, ProcessPhoenix, JobScheduler with setPersisted(true).
Netway traffic accessed local Linksys router administration interfaces and DOCSIS modem pages without RFC1918 filtering; Proxice permits direct access to 127.0.0.1:5555 and 192.168.x.x addresses.
Netway registers with backend C2 applinked5.ukturks.store via HTTPS GET and has a second HTML C2 channel allowing the server to order authenticated HTTP requests from the residential IP.
Netway integrates 3proxy and uses a reverse 3proxy tunnel (-r 79.127.248.199:10975) to traverse NAT and firewalls; the infrastructure mapped more than 60,000 unique residential IPs.
Netway and Proxice turn SuperBox devices into non-consensual residential proxy nodes; traffic is sent from victims' residential IP addresses.
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.