Loading story…
Nokia Deepfield researchers reported that the Jackskid DDoS botnet, the peer4you-mirai hybrid malware, and the trees4sale residential proxy service are linked to a single operator that abuses UPnP Internet Gateway Device port mapping to expose infected residential devices directly to the internet. Instead of routing traffic through outbound tunnels, the malware opens about 165 external router ports marked "RELAY", converting compromised home devices into proxy exits. The report ties the operations together through shared relay code, a byte-identical RCtea configuration key, overlapping infrastructure, and cryptocurrency wallets funded by the same upstream source.
The research says peer4you-mirai connects the DDoS and proxy activity, while newer Jackskid variants either deploy the relay as a second Android payload or embed it directly into Linux bot binaries. In addition to DDoS and proxy services, the operator reportedly uses compromised residential devices as a rotating C2 relay mesh populated from a /nodes director. The technique builds on the long-observed UPnProxy abuse pattern, but the newer campaign operationalizes it at scale for botnet control and commercial proxying. Defenders were urged to watch for SSDP discovery, SOAP AddPortMapping requests, and NAT entries whose description is "RELAY", which the researchers described as strong indicators of compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Nokia Deepfield ERT published research concluding that a single operator runs the Jackskid DDoS botnet, the peer4you-mirai hybrid malware, and the trees4sale residential proxy family, tied together by shared code, infrastructure, and wallet funding. The report also documented abuse of UPnP port mapping to expose infected residential devices as proxy exits and relay nodes.
On 2026-07-23, a Jackskid Android APK named com.android.s4protect dropped both the inix DDoS bot and a second payload, lol2, that implemented the peer4you relay.
In late July 2026, Jackskid Tier B Linux MIPS and ARM samples were observed compiling the relay directly into the DDoS bot, including the same SSDP discovery, UPnP AddPortMapping RELAY strings, and heartbeat telemetry logic.
The peer4you infrastructure's directors consolidated onto 185.104.63[.]79 in mid-July 2026, according to the report's infrastructure analysis.
The domain trees4sale[.]net, which had passive DNS history dating back to 2011, was operationalized for this malware activity in May 2026 as part of the residential proxy infrastructure.
Jackskid was disrupted in a March 2026 law-enforcement action targeting the broader Aisuru cluster. The report says the operation later regrouped after the disruption.
On 2026-07-27, the Android delivery node served com.android.wall.color.cinnamon, which removed the lol2 relay component and reverted to delivering only a single DDoS payload.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Black Lotus Labs reported a sprawling malicious residential proxy ecosystem built from compromised IoT and SOHO routers, Android devices, and Android TV boxes, tracking nearly **20 million distinct IPs per day** across **30+ botnet clusters**. The research identified major services and botnets including **IPIDEA, Jaguar, Kookeey, NetNut/Popa, G3Proxy, NSOCKS/Ngioweb, and ASOCKS/Nexusnet**, and said many operators both maintain their own botnets and resell access to other infected devices. Lumen said more than 20 of the clusters regularly exceed 100,000 daily victims, with roughly half of the tracked malicious proxy botnets operated by Chinese actors and many services excluding mainland China from their proxy pools. Separate analysis of the low-cost Android-based **Magcubic HY300 Pro+** projector showed how consumer hardware can feed that ecosystem. Investigators found preinstalled firmware components, including **`com.hotack.silentsdk`** and **`com.hotack.writesn`**, generating suspicious DNS requests such as **`usmyip.kkoip.com`** and appearing designed to register the owner’s IP address for possible enrollment into a residential proxy network without consent. Researchers warned the issue may extend to other inexpensive Android projectors tied to **Hotack, Huyukang, and Nonete**, reinforcing concerns that cheap, poorly vetted smart devices are being used as covert infrastructure for proxy botnets and related criminal activity, including card fraud operations and DDoS abuse.
Jul 30, 2026
Researchers reported multiple fast-moving IoT/Linux botnet campaigns built from **Mirai** and **Gafgyt** code that aggressively targeted embedded devices through known vulnerabilities and, in some cases, credential brute forcing. Palo Alto Networks said the campaigns—linked to evolutions of **Omni**, **Okane**, and **Hakai**—combined as many as 11 exploits in a single sample and introduced new distributed denial-of-service techniques, while related **Gafgyt** malware added an `HTTPCF` Layer 7 attack command aimed at Cloudflare-protected URLs. One newly adopted vector was the unauthenticated remote command execution flaw in **D-Link DSL-2750B** routers, which attackers incorporated shortly after public exploit tooling became available. The activity mirrors earlier reporting on **IoT_reaper**, a rapidly spreading botnet that also favored exploit-driven propagation over Mirai-style weak-password attacks. Netlab 360 said Reaper integrated at least nine exploits across products from **D-Link, Netgear, Linksys, AVTECH, GoAhead, JAWS,** and **Vacron**, maintained multiple command-and-control components, and at one point showed more than 10,000 daily active bot IPs on a tracked server, with millions of vulnerable devices queued for infection. Together, the reports show botnet operators quickly weaponizing public disclosures and modules to compromise internet-exposed routers and cameras at scale, then repurposing those infections for DDoS and broader botnet operations.
Aug 15, 2026
Researchers at **Lumen Black Lotus Labs** reported a new botnet malware, **KadNap**, that compromises **ASUS routers** and other edge networking devices to convert them into **residential-style proxies** used to relay malicious traffic. First observed in the wild in **August 2025**, the botnet has grown to **14,000+ infected devices**, with roughly **60%** of victims located in the **United States** and additional concentrations in **Taiwan, Hong Kong, and Russia**, plus smaller numbers across multiple other countries. KadNap is designed for resilience and evasion by using a **custom Kademlia-based Distributed Hash Table (DHT)** to obscure and decentralize command-and-control discovery, making takedowns and infrastructure mapping more difficult. Reported infection activity includes retrieval of a shell script `aic.sh` from `212.104.141[.]140` that establishes persistence via a **cron job** (running at the 55-minute mark each hour) and deploys an **ELF payload** (noted as `kad`) to install the client; infected nodes also query external IP and use **NTP** lookups for timing/uptime checks. Compromised devices are then monetized through a proxy service branded **Doppelgänger** (`doppelganger[.]shop`), assessed as a rebrand of **Faceless**, a proxy operation previously associated with **TheMoon** malware.
Jun 29, 2026