Threats Tagged 't1568'

Bandwidth-sharing applications like Peer2Profit recruit users to share their internet connections for payment, which are then monetized by commercial proxy services such as Astroproxy at significantly higher rates. These applications install with user consent via official channels, making detection by traditional security tools difficult. Research identified over 117,000 unique IPs in 72 hours, with residential IP pools growing rapidly. The proxy networks can access internal network resources through DNS entries resolving to internal IPs, posing risks of internal asset exposure. The scale and legitimacy of these networks create potential security risks for organizations where employee devices participate unknowingly.

A sophisticated traffic distribution system has been operating for over 14 months, using more than 12,700 structurally similar fake CAPTCHA PDFs hosted on Webflow's CDN. The operation begins with search engine optimization, where victims searching for legitimate content encounter malicious PDFs through Google searches. These documents contain fake CAPTCHA panels that route users through a custom Elixir/Phoenix traffic distribution system employing IP filtering, bot detection, and geographic targeting. The infrastructure sorts visitors and redirects qualifying traffic to three distinct endpoints: Legion Loader distribution, a TDS reseller gate, and premium-SMS subscription scams targeting Spanish-speaking users. Non-qualifying traffic is monetized through search-arbitrage advertising. The operation primarily targets English-speaking countries and has recently been surfaced by AI assistants including Google Gemini and Claude, expanding its reach beyond traditional search engines.

MediumMalwareUnited StatesAustraliaBritish Indian Ocean Territory+2#search engine poisoning#ai assistant exposure#webflow cdn abuse

Analysis of 4 million dynamic malware reports reveals that 45.32% of malware samples with command-and-control activity establish direct-to-IP (D2IP) connections, bypassing DNS entirely and evading DNS-based security defenses. D2IP traffic accounts for 23.17% of all C2 connection attempts. This behavior is observed across diverse threats including Phorpiex ransomware droppers using hard-coded IP addresses, persistent data exfiltration campaigns employing obfuscated HTTP GET requests, SectopRAT targeting educational institutions with in-browser proxy capabilities, and IoT botnets like Mozi and Boatnet propagating through P2P networks. The research introduces zero trust IP (ZT-IP), a network-level enforcement approach that verifies whether outbound connection destinations were previously sanctioned by DNS responses, effectively blocking malicious D2IP communications that traditional DNS-based security controls cannot detect.