Loading story…
Silent Push reported that devices enrolled in PEER2PROFIT are being monetized through the commercial proxy service ASTROPROXY, effectively turning user and potentially corporate endpoints into residential proxy exit nodes. Researchers validated the link by enrolling a controlled device in PEER2PROFIT and later observing its IP address offered in ASTROPROXY’s residential pool. Because the software is typically installed with user consent and is not generally classified as malware, the activity can evade traditional enterprise security controls while exposing an organization’s IP space to abuse, fraud investigations, and reputational damage.
During a 72-hour enumeration effort, the researchers identified 117,224 unique IPs across ASTROPROXY’s residential, mobile, and datacenter proxy pools, with the residential pool adding more than 1,000 new IPs per hour. The report also found that ASTROPROXY’s internal-IP filtering could be bypassed by using a DNS name that resolves to an internal address, potentially allowing proxy subscribers to reach internal resources such as router management interfaces through enrolled nodes. The findings highlight that bandwidth-sharing applications can create internal exposure and that proactive enumeration of proxy infrastructure may be more effective than reactive reputation-based blocking.
TTPs, infrastructure, and targeting history in one profile.
6 events from the most recent confirmed update back to the earliest known activity.
The references state that PEER2PROFIT has operated since at least 2021, paying users to share their internet connections for proxy traffic.
Silent Push published research concluding that PEER2PROFIT recruits user devices for bandwidth sharing while ASTROPROXY commercially resells that bandwidth, highlighting enterprise exposure and detection challenges.
Silent Push demonstrated the filtering bypass by reaching a MEO residential router management interface through a PEER2PROFIT-enrolled node exposed via ASTROPROXY and downloading a PNG file as proof of access.
The researchers found ASTROPROXY blocked direct requests to internal IP ranges but could be bypassed by using a DNS name that resolved to an internal address.
During a 72-hour crawl, Silent Push observed 117,224 unique IPs across ASTROPROXY's residential, mobile, and datacenter pools, with rapid churn including more than 1,000 new residential IPs per hour.
Silent Push enrolled a controlled device in PEER2PROFIT and later observed that device's IP address in ASTROPROXY's residential proxy pool, confirming an operational relationship between the two services.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 42 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
3 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcemalware.news
Open sourcesilentpush.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that residential proxy networks are increasingly being used to route malicious traffic through legitimate home internet connections, helping attackers evade IP reputation controls while making abuse appear to come from ordinary consumers and organizations. Infoblox said more than **65%** of its cloud customers queried domains tied to residential proxy services in 2026, with monthly DNS traffic rising from roughly **300–400 billion** queries in early 2025 to more than **500 billion** by April 2026, affecting every industry vertical examined, including healthcare, pharmaceuticals, banking, government, electronics, food and beverage, and industrial sectors. The company also observed no meaningful drop after disruption efforts against **IPIDEA**, and recorded a **265%** single-day spike in queries to `ipinfo[.]ipidea[.]io` on January 23. Separate telemetry from Gen Digital linked residential proxy traffic to **7.4 million** malicious incidents affecting **572,000** users since January 2026, with notable concentration in India, Vietnam, and Brazil. Researchers said devices are often enrolled through pay-for-bandwidth apps, free VPNs, browser extensions, bundled SDKs, preinstalled Android TV software, IoT devices, malware, and potentially unwanted applications, sometimes without clear user consent. The reports warn that these networks are being used for phishing, credential stuffing, account takeover, ad fraud, scams, scraping, and reconnaissance, while shifting legal, reputational, and performance risks onto households and enterprises whose IP addresses become exit nodes. Recommended mitigations include **Protective DNS**, DNS log reviews, auditing apps and browser extensions for embedded proxy components, inspecting connected devices, and removing unknown or suspicious software.
Jul 9, 2026
The FBI warned that cybercriminals are abusing residential proxy networks to mask their identities and relay malicious traffic through consumer and small-business internet connections. Devices may join these networks through SDK partnerships and bandwidth-sharing applications, deceptive “free” VPN terms, malware and backdoors, or compromised IoT devices. The proxy infrastructure can obscure command-and-control traffic and support phishing, account takeover, brute-force attacks, data exfiltration, fraud, spam, and illicit-market operations. A report titled **“SuperProxy: How Residential Proxy Networks Have Become Malware Delivery Platforms”** also identifies residential proxy services as infrastructure for malware delivery. Organizations should restrict unvetted software and bandwidth-sharing tools, promptly patch systems, segment and monitor networks, enforce device and firewall controls, and report suspected compromise to the FBI’s IC3.
Sep 4, 2026
Microsoft disclosed that **Midnight Blizzard** (`APT29`/`NOBELIUM`) breached its corporate environment by password-spraying a legacy non-production tenant account without MFA, then abusing OAuth applications and the `full_access_as_app` role to access Exchange Online mailboxes. Microsoft said the Russian state-backed actor used **distributed residential proxy infrastructure** to hide its activity, while Mandiant separately documented the same group using residential proxies, Microsoft-owned IP space via external Azure subscriptions, MFA self-enrollment abuse, and audit-log suppression to blend into normal Microsoft 365 traffic and sustain email collection against government and policy targets. A broader analysis of the residential proxy market found that these services are widely available through cybercrime forums and are increasingly used by both espionage actors and criminal groups for attribution resistance, phishing, spam, DDoS, and fraud. The report said proxy pools are built through proxyware installs, embedded SDKs, and compromised systems, and identified links among providers including **PiaS5Proxy**, **ABCProxy**, and **922Proxy** through shared cryptocurrency wallets and Hong Kong-linked entities, underscoring how opaque proxy ecosystems can materially support stealthy nation-state operations and prompting recommendations to detect and block proxyware inside enterprise environments.
Sep 3, 2026