Threats Tagged 'socks5 proxy'

Two multi-stage network intrusion campaigns are actively targeting organizations in Latin America, specifically in Mexico, Ecuador, and Brazil. The Mexican campaign targets transportation and government entities using living-off-the-land techniques and self-hosted NextChat instances. The Brazilian campaign targets financial organizations with custom remote access trojans (RATs) and tunneling tools, including a Go-based SOCKS5 proxy. Both campaigns leverage AI tools such as Claude and GPT-4.1 to generate scripts and troubleshoot operations. Operational security failures by attackers, including exposed staging directories and unsecured interfaces, have allowed defenders visibility into their activities. Indicators include multiple duckdns.org domains, an IP address, and various file hashes. There are no known exploits in the wild or confirmed active threat actors at this time.

MediumCampaignBrazilEcuadorMexico#phishing campaign#socktz#nextchat

A previously undocumented remote access tool named LabubaRAT has been identified, masquerading as NVIDIA software through fake metadata and runtime artifacts. This Rust-based malware creates persistent footholds enabling hands-on operator activity including host profiling, security tool identification, command execution, file transfers, screenshot capture, and traffic proxying. The implant supports multiple communication methods including HTTPS polling, WebView2-based communication, and DNS tunneling. It uses a configurable framework model with organization, group, server, and API key parameters suggesting a Malware-as-a-Service platform. The malware maintains local state in SQLite databases and provides comprehensive remote access capabilities including PowerShell and JavaScript execution, SOCKS5 proxy support, and user-level persistence through registry autoruns. Infrastructure analysis revealed LabubaPanel branding with associated command and control servers hosted on German providers.

A new variant of the TrickMo Android banking trojan was identified between January and February 2026, representing a substantial platform redesign rather than new capabilities. The malware has migrated its command-and-control infrastructure entirely onto The Open Network (TON) using .adnl endpoints, moving away from conventional internet infrastructure. Active campaigns have targeted banking and wallet users in France, Italy, and Austria. Once accessibility permissions are granted, operators gain real-time device control including credential phishing, keylogging, screen recording, SMS interception, and bidirectional remote control. New features include network reconnaissance capabilities and SSH tunnelling that transform infected devices into programmable network pivots and SOCKS5 proxy exit nodes, enabling operators to bypass IP-based fraud detection systems while accessing victim networks.

MediumMalwareFranceItalyAustria#ton network#trickmo#device takeover

A sophisticated ClickFix campaign has been uncovered, compromising legitimate websites to deliver a multi-stage malware chain. The attack culminates in MIMICRAT, a custom remote access trojan with advanced capabilities. The campaign uses compromised sites across industries and geographies for delivery, employing a five-stage PowerShell chain that bypasses security measures before deploying a Lua-scripted shellcode loader. MIMICRAT, the final payload, is a native C++ RAT featuring malleable C2 profiles, Windows token theft, and SOCKS5 proxy functionality. The attack chain involves multiple compromised websites, obfuscated scripts, and sophisticated evasion techniques, demonstrating a high level of operational sophistication.

MediumCampaignIndiaUnited StatesUnited Kingdom+7#lua loader#compromised websites#token theft