Adversaries have a wide range of mechanisms they can use to obfuscate their public internet protocol (IP) addresses to avoid attribution and reduce their detectable signature. Adversaries have used various types of nodes and services to proxy their traffic including commercial virtual private networks (VPN), virtual private servers (VPS), co-opted victim infrastructure, and more. Over time, defenders have been able to use adversary choices in infrastructure to surface illegitimate activity.
For example, “It’s not normal for our users to login from IP addresses associated with this or any VPS provider.” Some stealthy adversaries are using residential proxies, which fundamentally break some of the core assumptions about the detectable characteristics of infrastructure used for malicious activity. GreyNoise helped an organization identify one of these stealthy intrusions and separately revealed a malicious cyber actor conducting a proxyjacking campaign.
Product Demo to Incident Response
Sometimes the most interesting intrusions start with “this is either nothing or this is really bad.” Recently, GreyNoise gave a live product demonstration to an organization which identified GreyNoise-labeled malicious IP addresses in their Entra ID sign-in logs. The IPs appeared to be residential and in the geolocation that would make sense for the organization and users.
We assessed one or more devices behind the users’ network could be part of a proxy network with or without the users’ awareness and the logins could be legitimate despite warranting follow-up investigation. It is possible to observe legitimate logins from an IP address that is simultaneously proxying malicious traffic for an unrelated malicious cyber actor (MCA) against a completely unrelated target. Additional research into the IP addresses revealed they were indeed residential proxies. This datapoint validated the proxy hypothesis, but did not prove or disprove malicious activity at the organization.
As the organization investigated further, they discovered a much more alarming datapoint: multiple users were authenticating using one of the same residential IP addresses. There is a set of unlikely conditions that would need to be true for this to happen legitimately. The organization took more aggressive investigative actions and confirmed the activity was indeed a serious intrusion. GreyNoise will not publish details of the intrusion investigation identified through the product demonstration; however, it served as the basis for follow-up research into commercial residential proxy network abuse by malicious actors.
Proxy networks pose a challenge for a variety of entities trying to defend against intrusions, fraud, and other internet crimes. Residential proxies are especially challenging as they can be used to defeat detection mechanisms that rely on adversaries using IP addresses that are incongruent with the expected geolocation of a user, such as “Login from Impossible Travel Location.” Adversarial foreign intelligence entities continue to use residential proxies for these reasons.
Pawning Your Bandwidth
“Earn on your internet” is how Intel 471 describes residential proxies that allow participants to voluntarily install proxy software (proxyware) on their devices to turn their devices into nodes for the proxy networks. This grants any user of that proxy network the ability to interact with the internet using the participant’s IP address. The incentive for the participant is passive income. Additionally, some commercial proxy entities offer software development kits (SDK) for developers to integrate into their applications. In this model, the software developer earns revenue by selling the device owner’s bandwidth.
One company that operates with this model is Pawns.app. Pawns.app is a “direct partner” of IPRoyal and serves as a supply chain for obtaining proxy nodes that they then sell for a myriad of legitimate use cases. Pawns.app appears to be a rebrand of “IPRoyal Pawns” and is owned by the same people. Pawns.app offers pre-compiled and pre-packaged variants of their software, some of which are not visible until you establish an account on their site.
The command line variants accept variable username, password, and device information the installing party can specify at runtime. These features make it easy for them to be installed on a device an operator does not own, which is exactly what GreyNoise recently observed.
Pwning to Pawn Your Bandwidth
While “earn on your internet” is voluntary, proxyjacking is a crime. Proxyjacking is when an MCA forces victim devices into proxy networks in order to monetize their bandwidth. In a recent example, GreyNoise identified an MCA conducting a proxyjacking campaign against network edge devices globally to install Pawns.app on behalf of the attacker.
The actor successfully compromised at least 143 devices in 34 countries using exploits for the following vulnerabilities:
The MCA appeared to target other brands of digital video recorders/network video recorders (DVR/NVR) such as Hikvision and Dahua.
In some cases, the adversary also configured the victim devices to accept a secure shell (SSH) key authentication from the attacker as a backup access method for victim devices:
What We’re Doing About It
GreyNoise provides a free service (sign in or create a free GreyNoise account to access) for anyone to check if their IP has interacted with our Global Observation Grid. This serves as a potential indicator of proxyjacking. GreyNoise will also continue to provide respective government and law enforcement entities necessary details to disrupt, investigate, and bring perpetrators to justice.
What You Can Do About It
- Educate your users about the risks associated with installing free applications on their devices
- Educate your users about the importance of keeping their personal devices patched
- Detect residential proxy IP addresses in authentication logs, and especially scrutinize scenarios where multiple enterprise users are authenticating from the same residential proxy IP
- Detect deviations in user authentication behavior and characteristics beyond geolocation, such as mismatches in device identifiers, session identifiers, or User-Agent strings
Indicators of Compromise
These binaries are not necessarily malware unless installed without consent.
