Lumen Maps a Resilient Ecosystem of Malicious Residential Proxy Botnets
Summary
Lumen says it tracks over 30 malicious proxy botnet clusters, with nearly 20 million distinct IPs daily. Its analysis describes how operators share and resell access, enabling abuse and rapid recovery after disruptions.
Key points
- Lumen reports tracking more than 30 malicious proxy botnet clusters and nearly 20 million distinct IPs per day; over 20 clusters regularly exceed 100,000 daily victims.
- Compromised routers, IoT devices, Android devices and app-bundled SDKs supply residential IPs that can help users evade reputation checks, rate limits, fraud defenses and geoblocking.
- In one investigated fraud case, an actor used proxy services to select clean IPs by country and state when monetizing exposed credit-card data; Lumen says it alerted financial institutions and law enforcement.
- The report describes operators reselling one another’s proxy access, allowing services to replenish inventory and recover even when a botnet or storefront is disrupted.
- Lumen says IPIDEA recovered beyond its pre-disruption botnet size by early July 2026, while other networks also shifted infrastructure or drew on proxy partners.
- The researchers warn that proxy-hosting devices connected to corporate networks can provide routes for scanning and lateral movement.
- Lumen recommends monitoring suspicious logins from residential IPs, securing device-management interfaces, patching or replacing unsupported consumer devices, and coordinating disruption efforts across industry and law enforcement.
Article Details
- Attack Vectors
- Compromised IoT, SOHO routers, Android devices, and TV boxes are enrolled in residential proxy botnets through vulnerabilities, silent APK installations, preinstalled malware, and SDKs bundled with legitimate applications.
- Criminal users route activity through residential proxies to blend in with ordinary traffic, evade reputation-based blocking and geofencing, and conduct fraud, credential attacks, and scanning.
- In the reported fraud case, an actor used residential proxies selected by fraud score and location to monetize stolen credit-card data.
- The article reports that Kimwolf operators exploited devices behind residential proxies and turned proxy access into DDoS botnets.
- Botnet operators resell access to one another’s proxy pools, allowing services to restore operations after disruptions.
- Defensive Notes
- Continue monitoring for weak credentials and suspicious login attempts, including those originating from residential IP addresses; protect cloud assets from password-spraying traffic and block relevant indicators with web application firewalls.
- Secure device-management interfaces and prevent them from being accessible from the internet.
- Regularly reboot SOHO routers, install security updates and patches, and replace devices that have reached end of life and are no longer supported.
- Avoid TV boxes and televisions of dubious origin, and choose applications carefully because some may include SDKs that enroll devices in proxy networks.
- Telcos are encouraged to block malicious proxy-botnet C2 servers and use the cited IOC feed to identify users communicating with those botnets.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cyberprotector[.]online | Domains linked to NetNut-related infrastructure and seized as part of the NetNut operation. |
| DOMAIN | grassdata[.]net | Proxy-service domain identified in the article as one of IPIDEA’s new brands. |
| DOMAIN | ipidea[.]246810[.]club | Domain contacted in a bash-history script showing an actor using IPIDEA to monetize stolen credit-card data. |
| HOSTNAME | gate-hk[.]kookeey[.]info | Kookeey gateway used by the actor committing credit-card fraud through residential proxies. |
| HOSTNAME | zabbix[.]netnut[.]io | NetNut subdomain observed in connections associated with Popa C2 infrastructure and proxy-pool sharing. |
MITRE ATT&CK
T1090.002 · External ProxyFraud actors used residential proxy services, including Kookeey, to route activity through location-matched residential IPs.T1110.003 · Password SprayingThe article describes proxy botnets being used for password-spraying attacks.T1498 · Network Denial of ServiceThe article reports that Kimwolf operators exploited access to residential proxy devices to build DDoS botnets.T1595 · Active ScanningThe article says proxy customers may use the networks for mass scanning of the internet.T1657 · Financial TheftA fraud actor used residential proxies to monetize stolen credit-card data.
People
Threat Actors
Malware
KadNapon end-of-life devices and the use of more recent CVEs against unpatched equipment. Examples include KadNap, which powered Doppelganger, or Ngioweb, which powered NSOCKS. These services often lack sufficientKimwolfOne example is the proxy provider reported to be using the same malware packaged in Kimwolf installations. The word “ethical” appears, at the time of writing, on their website six times. This is despite the provider’sNgiowebof more recent CVEs against unpatched equipment. Examples include KadNap, which powered Doppelganger, or Ngioweb, which powered NSOCKS. These services often lack sufficient proxies to operate competitively, so theyPopasuch as Google and Shadowserver, NetNut operated one of the largest malicious proxy botnets known as Popa which, unlike the botnets we have discussed so far, was not operated by Chinese actors. Popa was commonlyTitanthe provider’s prior use of Kimwolf to grow its proxy numbers and its more recent association with the Titan botnet. Titan is commonly found in backdoored Android Package Kits (APKs) to enlist unknowing users and
Vendors
GoogleIn late January of 2026, Google disrupted one of the largest, if not the largest, malware-backed proxy services on the market, known as IPIDEA. While IPIDEA would recover within hours, the disruption resulted in theLumen Technologiestelemetry, for which we have developed algorithms to identify clusters of unusual activity across the Lumen backbone.
Products
Androidnumbers and its more recent association with the Titan botnet. Titan is commonly found in backdoored Android Package Kits (APKs) to enlist unknowing users and has amassed close to 500,000 daily victims.IPQualityScoreThe first part of the script checked their IPQualityScore (IPQS) keys, removing any that were currently or would become blacklisted to avoid reuse after the fact.
Countries
ChinaDespite worldwide victimization, we can see that very few of these victims exist within China.United StatesNext, since the majority of the stolen PII was for cards based in the U.S., the actors ensured the IPs they would be using were in the country.VietnamThe fraud actor was based in Vietnam and had compiled the essential Personally Identifiable Information (PII) for each victim, increasing the effectiveness of the card information sold to their malicious customers. The