More than a dozen n-day vulnerability exploits for various IoT devices, including Netgear and Zyxel products, have been leveraged to facilitate initial access, with the targeted devices establishing C2 communications to determine the usability of the bot for the proxy network and eventual connection with the NSOCKS proxy service, an analysis from Black Lotus Labs revealed. Additional findings showed the NSOCKS proxy network’s lacking security defenses, which have enabled exploitation of discoverable proxies in distributed denial-of-service, phishing, and credential stuffing attacks even for non-paying threat actors.

Source: SC Magazine