Security Report · github.com/jacobdjwilson

Plume Details How Residential Proxy Networks Deliver Malware to SuperBox Devices

Oct 21, 2026 · Original Report (PDF) ↗

Summary

Plume's 2026 research details hidden residential proxies on SuperBox devices, mapping over 60,000 Netway exit IPs and capturing 1,352 ADB attack sessions delivering CECbot, Mirai and Maskify through Popanet.

Key points

Plume found AppLinked silently initializes the Netway SDK, using Android service persistence mechanisms and 3proxy reverse tunnels to enroll devices without an opt-in.
Netway testing confirmed access to local network services on ports 80 and 443. A shared proxy password exposed in observed traffic enabled researchers to enumerate over 60,000 unique residential exit IPs across approximately 50 relay servers.
A Popanet-connected honeypot recorded 1,352 ADB attack sessions over more than three weeks: 562 associated with CECbot, 406 with Mirai and 384 with Maskify.
Captured payloads included CECbot APK installation attempts, a Mirai variant with 13 flood types, and Maskify, which retrieves encrypted configuration through ENS and binaries through IPFS.
Proxice dynamically loads signed DEX proxy modules, resolves control infrastructure through ENS using EtherHiding, and separates TCP signaling from QUIC tunnel traffic. Its destination handlers lack local-network and loopback filtering.
Most observed Proxice tunnel requests targeted Microsoft's login[.]live[.]com authentication endpoint. Researchers could not inspect the TLS payloads or determine whether authentication attempts succeeded.
Proxice ceased functioning during monitoring in late March, with shutdown or suspension uncertain. Plume reports that smaller residential proxy networks remained operational despite broader takedown activity.

Article Details

Publisher: Plume Security Labs
Report Period: 2026; includes a honeypot monitoring period exceeding three weeks
Scope: Residential proxy SDKs and malware affecting SuperBox devices, including proxy-mediated ADB exploitation and analysis of Netway and Proxice infrastructure.
Sample Size: 1,352 honeypot sessions; network mapping separately collected over 60,000 unique residential exit IP addresses.
Key Statistics: Over more than three weeks, a Popanet-connected honeypot recorded 1,352 attempts to reach ADB through the proxy network.
Manual malware classification attributed 562 sessions to CECbot, 406 to Mirai, and 384 to Maskify.
Netway registration requests across country codes returned approximately 50 distinct relay server IP addresses.
Enumerating Netway relay servers and session identifiers yielded over 60,000 unique residential IP addresses, described by the report as enrolled devices.
The researchers discovered five residential proxies on the same SuperBox device over several months.
Recommendations: Continuously scan applications in third-party application stores, including updated packages, rather than relying on occasional scans.
Apply stricter controls to installation of applications from unknown sources.
Restrict proxy access to local, private, reserved, and loopback destinations and protect exposed ADB services.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`beanman[.]site`	Additional encrypted C2 domain embedded in the Mirai binary; its code path was unreachable in the analyzed build.
DOMAIN	`zel[.]bio`	Additional encrypted C2 domain embedded in the Mirai binary; its code path was unreachable in the analyzed build.
HOSTNAME	`adb[.]loriascraft[.]xyz`	Purpose-built proxy-bypass infrastructure observed in hostile attempts to reach local ADB services.
HOSTNAME	`applinked5[.]ukturks[.]store`	Netway backend hostname used to register devices silently enrolled through AppLinked.
HOSTNAME	`boom[.]abuse[.]st`	Hostname resolving to 0.0.0.0 observed in hostile proxy-bypass traffic.
HOSTNAME	`local[.]keironellison[.]space`	Hostname resolving to loopback observed as proxy-bypass infrastructure in hostile ADB connection attempts.
HOSTNAME	`router-fw-nl1[.]virexa[.]pw`	Proxy-bypass attack hostname resolving to 0.0.0.0 and mimicking a router-management hostname.
HOSTNAME	`sa[.]spoofer[.]us`	Hostname resolving to 0.0.0.0 observed in hostile attempts to bypass proxy destination restrictions.
HOSTNAME	`sdk[.]ukturks[.]store`	Secondary Netway C2 endpoint for server-directed web retrieval jobs; this channel was present in code but not observed in use.
HOSTNAME	`test[.]sabakira[.]net`	Hostname resolving to loopback observed as proxy-bypass infrastructure in hostile ADB connection attempts.
HOSTNAME	`us-applinked5[.]ukturks[.]store`	Netway C2 hostname polled for reverse-proxy configuration every five minutes.
IPV4	`117[.]55[.]203[.]189`	Server delivering the Maskify APK through netcat downloads on port 1337.
IPV4	`158[.]94[.]208[.]131`	Maskify guardian callback server contacted on port 6969.
IPV4	`176[.]65[.]149[.]209`	Host identified in Proxice task descriptors as serving dynamically loaded proxy payloads.
IPV4	`195[.]201[.]56[.]160`	Hardcoded control server for the earlier Proxice MultiplexProxyEntry variant, using TCP port 9999.
IPV4	`5[.]175[.]215[.]37`	Proxice payload host serving mask_v3.dex in observed task descriptors.
IPV4	`5[.]175[.]215[.]41`	Hardcoded Proxice Entrypoint control server contacted over persistent TCP on port 9999.
IPV4	`79[.]127[.]248[.]199`	Netway relay to which enrolled devices establish reverse 3proxy connections on port 10975.
IPV4	`84[.]54[.]51[.]227`	Mirai callback destination used to exfiltrate Telnet credentials on port 13379.
IPV4	`92[.]112[.]127[.]184`	Malware staging server delivering a Mirai ARM ELF on port 5144 and an APK delivery path on port 1337.
IPV4	`93[.]95[.]115[.]175`	Hardcoded primary C2 address of the analyzed Mirai variant, using port 1337.
IPV4	`95[.]133[.]240[.]250`	Proxice payload host serving bytestream.dex and classes.dex in task descriptors.
URL	`hxxp[:]//empty-violet-63e1[.]maskify[.]workers[.]dev/`	Specific cloud-hosted APK URL supplied in the Maskify guardian configuration.