The Sing-box variant utilizes GitHub-hosted installation scripts, deploying a multipurpose proxy supporting vmess-argo, vless-reality, Hysteria2, and TUICv5 protocols, originally designed for bypassing geographic content restrictions but repurposed for criminal proxy networks. The attacks demonstrate tactical precision, with no extraneous malware deployment beyond the core proxy infrastructure, suggesting organized operations focused on building scalable proxy networks. Unlike conventional attacks focused on cryptocurrency mining or distributed denial-of-service operations, these intrusions specifically aim to transform compromised systems into proxy nodes within criminal networks. Cybercriminals have intensified their assault on poorly managed Linux SSH servers, deploying sophisticated proxy tools to establish covert network infrastructure. The sophisticated nature of these attacks indicates coordinated efforts by threat actors seeking to monetize compromised infrastructure through proxy-as-a-service offerings or to facilitate anonymization for subsequent criminal activities. ASEC researchers identified two primary attack patterns involving the installation of TinyProxy and Sing-box proxy tools. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. These attacks represent a shift from traditional malware deployment toward the strategic installation of legitimate networking tools for malicious purposes. The campaign targets Linux servers with weak SSH credentials, exploiting inadequate security configurations to gain unauthorized access. The malware removes existing Allow and Deny rules from /etc/tinyproxy/tinyproxy.conf, replacing them with Allow 0.0.0.0/0, effectively permitting unrestricted external access through port 8888. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 02 Jul 2025 17:45:18 +0000