Ngioweb Botnet Fuels Proxy Service NSOCKS: Exploiting IoT Devices at Scale

New findings have unveiled how the Ngioweb malware drives NSOCKS, a notorious residential proxy service, by exploiting vulnerable IoT devices and SOHO routers. This botnet operation, attributed to the financially motivated threat actor Water Barghest, exemplifies the growing commercial and underground markets for proxy services.

How Ngioweb Operates

1. Infection Mechanism:
   Using automated scripts, Water Barghest infiltrates devices such as routers, security cameras, and IoT devices via known vulnerabilities and zero-day exploits.
2. Two-Tiered Architecture:
1. Loader Network: 15-20 nodes direct bots to C2 servers.
2. Proxy Network: Devices that pass eligibility tests are enrolled into the proxy network for monetization.
3. Rapid Monetization:
   The infection-to-sale process takes just 10 minutes, making it highly efficient.

Residential Proxy Service and Risks

The infected devices are sold as SOCKS5 proxies on marketplaces like NSOCKS, VN5Socks, and Shopsocks5. NSOCKS enables users to:

1. Choose proxies by location, ISP, speed, and device type.
2. Route traffic through 180+ backconnect C2 nodes, obscuring their true identity.

Exploitation Use Cases

1. Credential Stuffing:
   Proxies have been used in attacks on organizations like Okta.
2. Distributed Denial-of-Service (DDoS):
   Open proxies are leveraged for powerful DDoS attacks.
3. Targeted Attacks:
   Malicious actors exploit proxies to attack specific entities, such as .gov and .edu domains.

Targeted Devices

Devices from leading vendors have been compromised, including:

NETGEAR, Reolink, Hikvision, Zyxel, NUUO, and others.

Impact and Implications

The scale and sophistication of the Ngioweb botnet pose significant risks:

1. Infrastructure Abuse:
   Compromised devices are exploited for illicit purposes, depleting resources.
2. Global Threat Expansion:
   With endpoints across 180 countries, the botnet facilitates cybercrime globally.
3. Focused Cyber Attacks:
   The ability to target specific domains or locations increases the severity of attacks.

Mitigation and Prevention

1. Secure IoT Devices:

1. Regularly update firmware.
2. Disable unnecessary services.
3. Enforce strong, unique passwords.

2. Monitor Network Traffic:
   Detect unusual activity, such as connections to suspicious C2 domains.
3. Block Malicious Domains:
   ISPs and enterprises should proactively block traffic associated with Ngioweb infrastructure.
4. Collaborative Action:
   Efforts by cybersecurity firms and ISPs, like those by Lumen Technologies, are crucial in disrupting these botnets.

The commercialization of botnets like Ngioweb demonstrates the evolving sophistication of cybercriminal operations. Organizations must strengthen their defenses and collaborate with security providers to mitigate these threats. The fight against residential proxy abuse is critical to safeguarding global digital infrastructure.