Who’s Behind the Botnet-Based Service BHProxies?
Summary: BitSight researchers found that 28 of 48 working proxies rented from the BHProxies residential proxy service (58.3%) were already present in their sinkhole systems tied to the Mylobot botnet, which BitSight says infects more than 50,000 unique systems daily. Mylobot, first identified in 2017 by Deep Instinct, runs in temporary memory and waits 14 days before contacting command and control servers, and BHProxies advertises access to more than 150,000 devices globally.
What you should know: A proxy service selling anonymity to paying customers may be routing their traffic through tens of thousands of compromised machines, with India the most targeted country followed by the United States, Indonesia and Iran - meaning traffic attributed to a residential IP may not belong to the person at that address.
Read the original at Krebs on Security ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026