Malicious Residential Proxy Botnets Linked to Compromised Android and IoT Devices

Black Lotus Labs reported a sprawling malicious residential proxy ecosystem built from compromised IoT and SOHO routers, Android devices, and Android TV boxes, tracking nearly 20 million distinct IPs per day across 30+ botnet clusters. The research identified major services and botnets including IPIDEA, Jaguar, Kookeey, NetNut/Popa, G3Proxy, NSOCKS/Ngioweb, and ASOCKS/Nexusnet, and said many operators both maintain their own botnets and resell access to other infected devices. Lumen said more than 20 of the clusters regularly exceed 100,000 daily victims, with roughly half of the tracked malicious proxy botnets operated by Chinese actors and many services excluding mainland China from their proxy pools.

Separate analysis of the low-cost Android-based Magcubic HY300 Pro+ projector showed how consumer hardware can feed that ecosystem. Investigators found preinstalled firmware components, including com.hotack.silentsdk and com.hotack.writesn, generating suspicious DNS requests such as usmyip.kkoip.com and appearing designed to register the owner’s IP address for possible enrollment into a residential proxy network without consent. Researchers warned the issue may extend to other inexpensive Android projectors tied to Hotack, Huyukang, and Nonete, reinforcing concerns that cheap, poorly vetted smart devices are being used as covert infrastructure for proxy botnets and related criminal activity, including card fraud operations and DDoS abuse.