Lurking Lizard's Proxy Network: Fake Services, Real Threats
How a threat actor turns devices into proxy nodes through deceptive installers and VPNs.
1Threat actor uncovered
Lurking Lizard, a threat actor active since at least 2022, has been using fake software installers, VPNs, and lookalike domains to covertly turn victims' devices into residential proxy nodes. Infoblox's research links over 230 domains to this operation, revealing a sophisticated infrastructure. The actor's campaigns include fake versions of popular tools like 7-Zip and WireVPN, all connected through shared tracking URLs and APIs.
2Deceptive recruitment tactics
The operation recruits compromised devices by disguising malicious installers as legitimate software downloads. Victims unknowingly download these fake installers, which then covertly transform their devices into proxy nodes. This method allows Lurking Lizard to build a distributed network of proxies without the device owners' knowledge or consent.
3Monetization strategy
Once devices are compromised, the actor monetizes the hijacked bandwidth through proxy services and fake review sites. The research suggests WireVPN may represent the latest evolution of this campaign, indicating ongoing refinement of their tactics. This end-to-end operation shows a clear profit motive behind the malicious activity.
4Infrastructure connections
Researchers connected seemingly separate campaigns by analyzing shared infrastructure elements like tracking URLs, deployment patterns, and APIs. This revealed the coordinated nature of the operation, with different fake services working together to expand the proxy network. The use of lookalike domains adds another layer of deception to the scheme.
5Scale of operation
With over 230 identified domains linked to Lurking Lizard, the operation demonstrates significant reach and organization. The actor maintains this extensive network while avoiding detection by distributing their infrastructure across multiple seemingly unrelated services and domains.
6Evolution of tactics
The inclusion of WireVPN in the campaign suggests the actor is continuously updating their methods. This adaptability makes the threat more persistent and harder to combat, as security measures must evolve alongside the attacker's techniques.
7Security implications
The research highlights how residential proxy networks can be built through covert means, posing risks to both individual device owners and network security overall. Compromised devices become unwitting participants in potentially illegal activities while suffering performance degradation.
8Detection challenges
Lurking Lizard's use of legitimate-looking services and distributed infrastructure makes detection difficult. Security teams must look for subtle connections between seemingly unrelated campaigns to uncover such operations, requiring advanced threat intelligence capabilities.
Original article: CyberWire Daily — Lurking Lizard's Proxy Network: Fake Services, Real Threats