Ngioweb’s Proxy Pandemonium: How Your Smart Fridge Might Be Moonlighting in Cybercrime
Ngioweb malware is the quiet star behind NSOCKS, a notorious residential proxy service. Lumen Technologies’ findings reveal Ngioweb’s role in fueling NSOCKS with bots from compromised IoT devices. These bots, mainly in the U.S., enable cybercriminals to launch attacks while safeguarding their anonymity.
Hot Take:
This malware is like a bad house guest – it sneaks in through your IoT doorbell, doesn’t leave, and before you know it, your espresso machine is moonlighting as a proxy server. Who knew your smart fridge had a side gig in cyber espionage?
Key Points:
- Ngioweb is the engine behind the NSOCKS residential proxy service, with up to 80% of bots originating from this botnet.
- The malware targets IoT devices and SOHO routers, primarily in the U.S., with many bots active for over a month.
- The botnet, controlled by the Water Barghest group, monetizes by selling infected devices as proxies on marketplaces.
- Attack vectors include IoT devices from various vendors, employing a two-tiered architecture for infection and operation.
- NSOCKS proxies are used for malicious activities, including credential-stuffing attacks and DDoS operations.
Already a member? Log in here