"Black Proxies Enable Threat Actors to Conduct Malicious Activity"

Security researchers at DomainTools have discovered that threat actors are using criminal proxy networks to obfuscate their illegal activities by hiding behind hijacked IP addresses and using the same to create an appearance of legitimacy.  The researchers stated that while these networks were initially used as part of botnets, their lucrative nature has turned them into their own criminal enterprises.  The researchers noted that they spotted a new and particularly dangerous proxy service called "Black Proxies," which is being marketed to other cybercriminals for its reliability, scope, and vast number of IP addresses.  Black Proxies market themselves as having over 1,000,000 residential and other proxy IP addresses worldwide.  The researchers stated that the scope and scale of these new offerings show just how large their claimed pool of IP space is.  Upon further examination through the service, their pool of IP addresses listed in the Fall of 2022 "online" comes in at just over 180,000 IPs, which is still a factor larger than the traditional services based on other types of tactics and botnets.  According to the researchers, the Black Proxies' scale is significant because of not only their focus on both the traditional forms of IP proxying but also their use of compromised websites for their services.

Infosecurity reports: "Black Proxies Enable Threat Actors to Conduct Malicious Activity"