Dangerous global botnet fueling residential proxies is being hit in major crackdown

• Security researchers from Lumen's Black Lotus were investigating the ngioweb botnet for more than a year
• After identifying the infrastructure and traffic, the company started blocking the data flow
• The botnet, and the proxy service NSOCKS, are severely disrupted as a result

Security researchers have disrupted a major malicious botnet, and thus also hurt the proxy service it powered.

Cybersecurity researchers from Lumen’s Black Lotus have released a new report saying they blocked all traffic across their global network that went to, or from, the dedicated infrastructure associated with the ‘ngioweb’ botnet.

The Ngioweb botnet, first spotted in mid-2023, operated more than 35,000 bots (compromised endpoints, basically) every day. The bots were located in 180 countries and were used, first and foremost, to power the NSOCKS proxy service. This “notorious criminal proxy service”, as Black Lotus describes it, is linked to the threat actor known as Muddled ...