Loading story…
Darktrace reported rising activity tied to GhostSocks, a Go-based malware-as-a-service offering advertised on the Russian-language forum xss[.]is, which turns infected systems into residential SOCKS5 proxy nodes. The malware is designed to help threat actors evade IP-based detection and geographic restrictions by routing traffic through victim devices, using a relay-based command-and-control architecture and TLS-wrapped proxy traffic for stealth. Later variants added persistence through Windows registry run keys and expanded functionality beyond proxying to include backdoor features for arbitrary command execution and payload delivery.
The company said GhostSocks saw broader adoption after a 2024 partnership with Lumma Stealer and has also been linked to use by the Black Basta ransomware group for maintaining long-term access. In a December 2025 incident at an education-sector organization, a device contacted Lumma-linked infrastructure, downloaded a GhostSocks-associated executable called Renewable.exe, retrieved additional payloads from suspicious endpoints, and began likely early-stage beaconing to rare external destinations. Darktrace said blocking actions were recommended multiple times, but because the customer was operating in Human Confirmation Mode, mitigations were not automatically enforced, allowing the activity to continue.
Get the actors, campaigns, and ATT&CK mapping behind it.
8 events from the most recent confirmed update back to the earliest known activity.
Darktrace published detailed reporting on GhostSocks, describing its architecture, persistence mechanisms, Lumma partnership, and observed customer activity. The reports warned that infrastructure takedowns alone are unlikely to stop abuse because operators can quickly rebuild and continue monetizing victim systems as proxy nodes.
During the December 2025 education-sector incident, Darktrace's Autonomous Response repeatedly recommended blocking actions. Because the customer was operating in Human Confirmation Mode, the mitigations were not automatically enforced and the activity continued.
In December 2025, Darktrace observed an education-sector customer device contact infrastructure linked to Lumma and download a GhostSocks-associated executable, identified in one report as Renewable.exe. The host then retrieved additional payloads from suspicious endpoints and began likely early-stage command-and-control beaconing.
From late 2025, Darktrace said it observed increasing GhostSocks-related activity across its customer base. The trend suggested growing operational use of the malware in real-world intrusions.
SpyCloud Labs published analysis of GhostSocks on 2025-03-25, detailing its linkage to LummaC2, registry run-key persistence, static embedded configuration with dynamic C2 updates, and TLS 1.3-wrapped SOCKS5 relay traffic. The report also released a YARA rule, sample hashes, infrastructure IPs, and build distinctions tied to different GhostSocks creation methods.
GhostSocks was reportedly used by the Black Basta ransomware group to maintain long-term access in victim environments. This reflected the malware's role beyond proxying, including persistence and backdoor-style access.
In 2024, GhostSocks reportedly saw broader adoption after a partnership with Lumma Stealer was announced. The linkage helped expand its use among threat actors seeking stealthy residential proxy access and follow-on intrusion capability.
GhostSocks emerged as a Go-based malware-as-a-service offering on the Russian-language forum xss[.]is, marketed to turn infected devices into residential SOCKS5 proxies. Its capabilities included relay-based command-and-control, TLS-wrapped proxy traffic, and backdoor functions for command execution and payload delivery.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 89 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
darktrace.com
Open sourcedarktrace.com
Open sourcespycloud.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that **GhostSocks**, a Golang-based SOCKS5 backconnect proxy sold as a malware-as-a-service, is tightly integrated with the **LummaC2** infostealer ecosystem and can be automatically deployed on Lumma-infected hosts through a partnership promoted on Telegram. GhostSocks supports both **Windows** and **Linux**, stores an obfuscated JSON configuration in `%APPDATA%\config`, communicates with relay-based C2 infrastructure over HTTP, and assigns infected systems as Tier 1 backconnect nodes to create SOCKS5 tunnels for criminal customers. Analysts said the malware also enables arbitrary command execution, SOCKS5 credential changes, and download-and-execute activity, extending Lumma-compromised machines beyond credential theft into proxy infrastructure for follow-on abuse. Separate analysis of **LummaC2 v4.0** showed the stealer continuing to evolve with stronger evasion and anti-analysis features, including control-flow-flattening obfuscation, XOR-encrypted strings, dynamic C2-delivered configuration, and a two-layer packer designed to frustrate reverse engineering. KrakenLabs found Lumma delays execution until it detects human-like mouse movement, calculating cursor angles and restarting its checks if movement appears unnatural, a technique that can block detonation in sandboxes. The combined findings indicate that Lumma operators and affiliates are pairing a mature infostealer with a dedicated proxy service, while using anti-sandbox protections and hardened packing to reduce detection and sustain access.
Aug 15, 2026
Gootloader malware has re-emerged after a period of inactivity, deploying new techniques to compromise victims through SEO poisoning and malicious JavaScript injected into compromised or attacker-controlled websites. Recent attacks observed by Huntress and other researchers show Gootloader being used to gain initial access to corporate networks, with one incident resulting in a Domain Controller compromise within 17 hours. The loader, operated by the threat actor Storm-0494, provides access to Vanilla Tempest, which then deploys backdoors such as the Supper SOCKS5 and ultimately delivers ransomware, including the Rhysida family. The infection chain leverages obfuscated JavaScript, custom WOFF2 fonts, and XOR-encrypted ZIP archives, with payloads tailored to evade static analysis and exfiltrate sensitive information from active user sessions. The distribution method relies heavily on SEO poisoning, where fake legal document and agreement template sites are promoted in search results, enticing users to download malicious files. Once executed, Gootloader runs PowerShell scripts to enumerate environment variables, running processes, and desktop files, sending this data to hardcoded C2 servers. The operation's infrastructure has been actively targeted by security researchers, leading to a temporary cessation in March 2025, but the campaign has since resumed with new tricks and payloads, including Cobalt Strike and various backdoors. The renewed activity highlights the persistent threat posed by Gootloader and its affiliates, who continue to refine their tactics to evade detection and maximize impact on targeted organizations.
Jun 29, 2026
Multiple security firms reported ongoing campaigns targeting Chinese-speaking Windows users with fake or trojanized installers for popular software, including **Google Chrome**, **Microsoft Teams**, **Surfshark**, **Signal**, **Telegram**, **Zoom**, **DeepSeek**, **Quark Cloud**, and activation tools. The attacks rely on spoofed download sites and malicious `MSI` or `NSIS` packages that decrypt payloads in memory and ultimately deploy remote-access malware tied to the **Gh0st RAT** ecosystem, including modified Gh0st variants and **Atlas RAT**. Researchers linked the activity to Chinese-speaking threat actors including **Dragon Breath** and **Silver Fox**, noting refreshed infrastructure, low detection rates, and lures designed to appear legitimate, in some cases using AI-generated web pages and valid code-signing certificates. The intrusion chains emphasize defense evasion before full payload delivery. Reported techniques include abuse of signed or vulnerable kernel drivers to terminate or disable more than 200 security products, unsigned `WDAC` policies to block Chinese antivirus tools, **Protected Process Light** abuse to corrupt **Microsoft Defender**'s `MsMpEng.exe`, phantom DLL side-loading, thread-pool-based process injection, in-memory reflective loading, and persistence through services, scheduled tasks, and watchdog scripts. Once installed, the malware supports encrypted command-and-control, command execution, keylogging, clipboard theft, active-window logging, RDP session hijacking, and additional payload delivery, underscoring a sustained pattern of installer-based malware operations aimed at users seeking trusted software from unofficial sources.
Aug 14, 2026