The evolution and abuse of proxy networks
Summary: Cisco Talos traces how proxy networks evolved from privacy tools into attack infrastructure, starting with proxyware abuse like Honeygain and moving to VPNFilter, the first large-scale state-sponsored proxy network, which compromised roughly 500,000 small office and home office routers with malicious firmware. Russian-aligned actors followed with Cyclops Blink, and the targeting has since widened to NAS and IoT devices, with the FBI in September taking down a botnet tied to Chinese hacking activity largely associated with Volt Typhoon.
What's compelling: These peer-to-peer botnets let attackers appear to come from residential IP space geographically adjacent to the victim, and when they pair that with legitimate credentials, organizations have little hope of stopping the connection on IP or authentication alone.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026