{
  "family": "proxyweb",
  "sample_count": 4,
  "category": "trojan",
  "description": "Trojan:Win32/Proxyweb is a type of malware that silently converts an infected endpoint into a proxy server or relay node for a larger botnet. Instead of stealing data or encrypting files, Proxyweb's primary goal is to monetize the victim's internet connection and IP address by selling it to other cybercriminals, who use it to hide the true origin of their malicious traffic (like credential stuffing, DDoS attacks, or spam campaigns).<br><br><b>Understanding Proxyweb (Proxy Botnets)</b><br>To an end-user, a Proxyweb infection might only manifest as a sluggish internet connection or unexplained bandwidth overage charges. For an enterprise security team, it represents a significant liability. If a corporate workstation is infected with Proxyweb, the company's IP address will be used to launch attacks against other organizations, potentially leading to the company's IP block being blacklisted by major threat intelligence feeds and service providers.<br><br><b>Execution and Relay Mechanics</b><br>Proxyweb is often distributed silently alongside bundled software, fake game cracks, or via drive-by downloads (`T1189`). Upon execution, it establishes persistence, often via Registry Run keys or Scheduled Tasks (`T1547.001`). The malware binds a local port on the infected machine and opens an encrypted connection to a Command and Control (C2) server, registering the machine's IP, geographic location, and bandwidth capacity with the botmaster (`T1071.001`). The C2 server then begins routing third-party traffic (often SOCKS4/SOCKS5 or HTTP proxy traffic) through the infected host (`T1090.003`). The infected machine receives requests from the attacker, forwards them to the target server, and sends the response back to the attacker, acting as a complete middleman.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is network bandwidth exhaustion and severe reputational damage (IP blacklisting). Host-based IoCs include EDR alerts for anomalous processes binding listening ports, or unexpected modifications to the Windows Firewall to allow inbound connections. Network IoCs are highly visible: massive amounts of anomalous outbound traffic (often HTTP or HTTPS) to completely unrelated and diverse IP addresses, originating from a single workstation rather than a proxy server.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.004",
    "T1547.001",
    "T1090.003",
    "T1071.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1090.003",
      "name": "Proxy: Multi-hop Proxy (Acting as a relay node for attackers)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1071.001",
      "name": "Application Layer Protocol (Communicating with the botmaster)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution",
      "tactic": "Persistence"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall (Opening ports for proxy traffic)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint from the network to immediately halt the illicit proxy traffic and stop the abuse of the corporate IP address.",
    "Review firewall and network flow logs for the infected machine to determine the scope of the proxy activity (e.g., what external sites were being attacked through your network).",
    "Run a full anti-malware scan to remove the Proxyweb executable and delete the associated persistence mechanisms and firewall rules.",
    "Check major threat intelligence and spam blacklists (e.g., Spamhaus) to ensure the corporate external IP address has not been blacklisted, and request delisting if necessary."
  ],
  "what_to_avoid": [
    "Do not ignore alerts from ISPs or external organizations claiming your IP address is attacking them; this is a classic symptom of a proxy botnet infection inside the perimeter.",
    "Avoid allowing workstations to act as servers; enforce strict egress filtering at the firewall to block anomalous outbound ports commonly used by proxy malware."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}