Any type of proxy can be used here, such as socks5, socks4, Http, https. With Proxychains, hackers can chain numerous proxies and use the TOR browser to execute their actions so that investigators cannot trace the actual IP address. Unsecured home networks, poor VPN usage, and lack of cybersecurity awareness training have compounded the problem. Many organizations are still struggling to enforce cybersecurity policies and patching process in a timely manner, making internet-facing servers and devices more vulnerable than ever. COVID-19 pandemic has resulted in many organizations migrating workforce to a remote model in a hurry.Once the exposed servers such as ElasticSearch or MongoDB are identified by the attackers (via Shodan or Censys), attackers can kickstart campaigns to exfiltrate data, cause DDOS, or embark on cryptomining, etc. Open proxies are freely available on the surface web for hackers to launch attacks against exposed servers.This out-of-band report deep dives into open proxy usage by state-sponsored actors, attacks scenarios to prepare for, and other recommendations. Threat actors use open proxy to achieve their goals more effectively and anonymously. Threat actors continue to expand their infrastructure, steal data from internet-facing systems, and build initial footholds into their target organizations with the objective of launching further cyber-espionage.

Since then, these threat actors have accelerated their campaigns targeting a wide mix of industries in Japan as well as other markets.ĬYFIRMA’s flagship product, DeCYFIR, has been picking up signals indicating these threat actors are scanning, brute forcing and exploiting vulnerability using proxies to hide their original attack sources. CYFIRMA research first alerted clients on the increase in open proxy usage as the attack method by known nation-sponsored actor groups in Apr 2020.