GreyNoise Analysis Reveals Proxyjacking Campaign Targeting 143 Devices Globally
GreyNoise research details a campaign where edge devices were co-opted into residential proxy networks, complicating threat detection for security teams.
Key points
- GreyNoise identified a proxyjacking campaign affecting 143 devices across 34 countries.
- The campaign uses residential proxies to bypass geolocation-based detection mechanisms.
- A live product demonstration revealed an intrusion where multiple users authenticated via one IP.
GreyNoise published first-hand research detailing a proxyjacking campaign that co-opted 143 edge devices across 34 countries into residential proxy networks. The analysis highlights how adversaries leverage these nodes to obfuscate their internet protocol addresses and avoid attribution. This activity fundamentally breaks core assumptions about the detectable characteristics of infrastructure used for malicious activity, making it harder for defenders to surface illegitimate behavior.
The findings emerged from a live product demonstration where an organization noticed GreyNoise-labeled malicious IP addresses in their Entra ID sign-in logs. Although the IPs appeared residential and geographically consistent with expected user locations, further investigation revealed multiple users authenticating via the same address. This unlikely condition prompted aggressive investigative actions that confirmed a serious intrusion, validating the hypothesis that devices behind the network were part of a proxy network.
The Mechanics of Proxyjacking
Residential proxies present a significant challenge for entities defending against intrusions, fraud, and other internet crimes. Adversaries use these networks to defeat detection mechanisms that rely on incongruent IP addresses, such as alerts for impossible travel locations. By using a victim’s residential IP, attackers can make their traffic appear legitimate, even if the login is simultaneous with malicious traffic proxying against unrelated targets.
GreyNoise noted that while the initial demonstration data validated the proxy hypothesis, it did not immediately prove malicious activity at the organization. However, the convergence of multiple users authenticating from a single residential IP address served as a critical indicator. This specific pattern distinguished the activity from standard benign usage, leading to the confirmation of the breach.
Supply Chain and Incentives
The campaign relies on a model described by Intel 471 as "earn on your internet," where participants voluntarily install proxy software on their devices. This software turns personal devices into nodes for proxy networks, granting users of the network access to the participant’s IP address. The primary incentive for participants is passive income, while some commercial proxy entities offer software development kits for developers to integrate into applications.
One company operating under this model is Pawns.app, which serves as a direct partner and supply chain for IPRoyal. Pawns.app appears to be a rebrand of IPRoyal Pawns and is owned by the same individuals. These entities sell proxy nodes for various legitimate use cases, but the infrastructure is simultaneously abused by malicious cyber actors to hide their true origins and evade detection.
What should you do?
Security teams should monitor authentication logs for anomalies where multiple distinct users authenticate from the same residential IP address. Organizations should verify that all devices on their network are authorized and free of unknown proxy software. Administrators should review geolocation data in sign-in logs for inconsistencies that might indicate proxy usage rather than actual user location.
What to do and how to stay safe: GreyNoise
- Review Entra ID or similar identity logs for multiple user authentications originating from a single residential IP address.
- Scan internal networks for unauthorized proxy software or services that may be selling device bandwidth.
- Correlate sign-in geolocation with known residential proxy lists to identify potential proxyjacking activity.
- Investigate any simultaneous legitimate logins and malicious traffic originating from the same internal IP address.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
How many devices were affected by the proxyjacking campaign?
GreyNoise identified 143 devices across 34 countries as part of the proxyjacking campaign.
What is proxyjacking?
Proxyjacking is the co-opting of edge devices into residential proxy networks, allowing adversaries to mask their IP addresses.
Which companies are linked to this proxy model?
Pawns.app, which appears to be a rebrand of IPRoyal Pawns, is identified as a direct partner of IPRoyal in this model.
