How Peer2Profit and Astroproxy Turn Your Bandwidth Into Someone Else's Product

This threat involves residential proxy networks operated by Peer2Profit and Astroproxy, which recruit users to share their bandwidth through applications installed with consent. The shared bandwidth is resold commercially at up to 27 times the original cost. Researchers identified 117,224 unique IP addresses across residential, mobile, and datacenter pools within 72 hours, with residential IPs increasing by over 1,000 per hour. Reverse engineering of the Windows SDK revealed the communications protocol and backconnect infrastructure coordinating proxy sessions. Testing demonstrated that these proxy networks can access internal network resources by resolving DNS entries to internal IP addresses, potentially exposing corporate assets. The applications' installation through official channels and their scale make them invisible to traditional security tools, posing a significant risk to organizations.

The threat enables commercial proxy services to leverage user bandwidth without clear visibility to security tools, potentially exposing internal network resources through proxy access. This can lead to unauthorized access to corporate assets if internal IPs are resolvable via the proxy network. The large scale and rapid growth of these proxy pools increase the attack surface and risk of data exposure or misuse of internal resources. Organizations with employees running these applications may unknowingly expose their internal networks to external parties.

No official patch or vendor advisory is available for this threat. Since the applications install with user consent and operate through legitimate channels, traditional security tools may not detect them. Organizations should consider monitoring for unauthorized proxy usage on endpoints, educate employees about the risks of bandwidth-sharing applications, and restrict installation of such software through endpoint management policies. Network segmentation and DNS filtering may help reduce exposure of internal resources via proxy networks. Patch status is not yet confirmed — check vendor advisories or security bulletins for updates.