Threats Tagged 'astroproxy'

Peer2Profit and Astroproxy are bandwidth-sharing applications that recruit users to share their internet connections for payment. This bandwidth is then monetized through a commercial proxy service at significantly higher rates. The applications install through official channels with user consent, making them difficult to detect with traditional security tools. Researchers identified over 117,000 unique IPs in 72 hours, with rapid growth in residential IPs. Reverse engineering revealed the communications protocol and backconnect infrastructure managing proxy sessions. Testing showed these proxy networks can access internal network resources via DNS entries resolving to internal IPs, potentially exposing corporate assets. The scale and internal access capabilities present significant risks to organizations where employees run these applications.