Ngioweb Botnet Powers NSOCKS Proxy Network Using IoT Devices

Title: Ngioweb Malware Fuels Growing Threat of Residential Proxy Services

Introduction

Recent findings from Lumen Technologies have revealed that the notorious Ngioweb malware is fueling a significant residential proxy service known as NSOCKS, along with other services like VN5Socks and Shopsocks5. This alarming development highlights the increasing sophistication of cybercriminals using malware to monetize compromised devices. The Ngioweb botnet, with an average of 35,000 operational bots daily, poses a substantial threat to both consumers and organizations alike.

Understanding Ngioweb: A Growing Cyber Threat

Ngioweb, initially documented by Check Point in August 2018, has undergone extensive analysis by cybersecurity firms such as LevelBlue and Trend Micro. The malware, which targets devices running Microsoft Windows and Linux, gets its name from a command-and-control (C2) domain registered back in 2018. As of October 2024, the botnet is estimated to comprise over 20,000 Internet of Things (IoT) devices, exploited by the financially motivated threat actor known as Water Barghest.

How Ngioweb Operates

• Automated Infiltration: The Ngioweb malware uses automated scripts to identify and exploit vulnerabilities in IoT devices, registering them as proxies.
• Quick Monetization: Researchers have noted that the process of infection to proxy availability can be completed in as little as 10 minutes, showcasing the efficiency of this operation.
• Diverse Targets: The malware has successfully compromised a wide range of devices from manufacturers such as NETGEAR, Hikvision, and Reolink.

The Role of Residential Proxy Services

The infected devices are sold on residential proxy marketplaces like NSOCKS, which has previously been involved in credential-stuffing attacks targeting platforms like Okta. NSOCKS offers buyers the ability to select proxies based on various criteria, including location, device type, and speed.

The Risks of NSOCKS and Similar Services

• DDoS Attack Potential: Open proxies provided by NSOCKS can be exploited for large-scale distributed denial-of-service (DDoS) attacks.
• Global Reach: Users of NSOCKS can choose from over 180 countries for their endpoint, allowing malicious actors to conduct attacks while obscuring their identities.
• Targeted Attacks: The capability to focus attacks on specific domains, such as government (.gov) or educational (.edu) sites, raises concerns about potential threats.

Mitigation Efforts

In response to these threats, Lumen Technologies has taken proactive measures to block all traffic associated with the Ngioweb botnet infrastructure. However, the demand for residential proxy services is expected to grow, driven by advanced persistent threat (APT) groups and cybercriminal organizations.

Conclusion

The emergence of Ngioweb malware as a driving force behind residential proxy services like NSOCKS underscores the evolving landscape of cyber threats. As criminals continue to exploit vulnerabilities in IoT devices, the need for robust cybersecurity measures becomes increasingly critical.

Call-to-Action

What are your thoughts on the growing threat of residential proxy services powered by malware? Share your insights in the comments below, and be sure to check out our related articles on cybersecurity trends and IoT vulnerabilities.

For more in-depth analyses on cybersecurity, follow us on Twitter and LinkedIn.