MalwarePublished 1 Oct 2025Updated 31 Oct 2025

GhostSocks: From Initial Access to Residential Proxy

Source AlienVault OTX General

Description

GhostSocks is a Malware-as-a-Service (MAAS) that converts compromised devices into residential proxies, enabling threat actors to bypass anti-fraud mechanisms. Introduced in October 2023, it gained popularity after partnering with LummaStealer in February 2024. The malware, coded in Golang, uses obfuscation techniques and can be built as a 32-bit DLL or executable. It doesn't implement persistence mechanisms but focuses on SOCKS5 functionality. GhostSocks uses a configuration file or hardcoded config to connect to C2 servers, randomly generates credentials, and establishes a SOCKS5 connection using open-source libraries. Despite law enforcement actions against related platforms, GhostSocks continues to operate, posing ongoing risks of double victimization and long-term network access for cybercriminals.

Impact

For European organizations, GhostSocks presents a multifaceted threat. Infected devices within corporate or home networks can be covertly repurposed as proxies, enabling attackers to route malicious traffic through legitimate European IP addresses, thereby bypassing geo-restrictions and anti-fraud systems commonly used in financial services, e-commerce, and governmental sectors. This can facilitate fraud, data exfiltration, and further lateral movement within networks. The lack of persistence means infections may be transient but can recur if initial access vectors remain unmitigated. The partnership with LummaStealer suggests that credential theft is a component of the attack chain, increasing risks of account compromise and unauthorized access to sensitive systems. Additionally, the use of residential proxies complicates incident response and attribution, potentially delaying detection and remediation. The risk of double victimization means that organizations may suffer both direct compromise and indirect harm through their devices being used in broader criminal infrastructures. This can damage reputation, incur regulatory penalties under GDPR for inadequate security, and lead to financial losses from fraud or operational disruption.

Defensive guidance

European organizations should implement targeted mitigations beyond generic advice: 1) Monitor network traffic for unusual SOCKS5 proxy activity, especially outbound connections to known C2 IPs and domains associated with GhostSocks. 2) Employ endpoint detection and response (EDR) solutions capable of detecting Golang-based malware and obfuscation patterns. 3) Harden initial access vectors by enforcing multi-factor authentication, especially to prevent credential theft facilitated by LummaStealer. 4) Regularly audit and restrict proxy and tunneling protocols within corporate networks to prevent unauthorized proxy usage. 5) Conduct threat hunting exercises focusing on the identified IoCs such as specific IP addresses, hashes, and domain names. 6) Educate users about phishing and credential theft risks to reduce infection likelihood. 7) Implement network segmentation to limit lateral movement and isolate infected devices quickly. 8) Collaborate with ISPs and law enforcement to report and mitigate proxy abuse originating from residential IPs. 9) Maintain updated threat intelligence feeds to detect emerging variants or related malware campaigns. 10) Since GhostSocks does not persist, rapid detection and remediation of infected hosts can effectively reduce impact.

Indicators of compromise

Domains 1

proton66.ru

URLs 2

https://synthient.com/blog/ghostsocks-from-initial-access-to-residential-proxy
http://46.8.232.106:30001/api/helper-first-register?buildVersion=0pTk.PWh2DyJ&md5=&proxyPassword=&proxyUsername=&userId=

IP addresses 6

86.54.24.25
147.45.196.157
46.8.232.106
46.8.236.61
91.212.166.9
91.212.166.91

Hashes 7

41dc5b08632cd0247b0ada4ed36f2b68
d0eb82fd3774f614ee28f148f3681ca48677f0ff
b4709cfb8f9cf0eaabe16ab218d60a0e64c3fa568d42fcac51f867e1d2cdc1fe
cda5f18be615ad27e0477c6d249d245d368ac1de81ee48239a3e39814345c04d
f52fa1b8be929a42aafab8f0a80932e52b949ee35498f22b6d58e5e6ed107b99
6d43038a57935fcf9776867ce9d3e1a3e82d0d52
79ed3c266d878e69537b633159beba74edb0bdee

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Oct 2025, 08:50 UTC

MITRE ATT&CK techniques13 from threat tags

Technical details