Loading threat actor…
ASOCKS, also associated with Nexusnet, is a malicious residential proxy service tied to a broader criminal ecosystem that monetizes access to compromised devices as proxy infrastructure. It has been linked to botnet-backed proxy operations in which infected endpoints are offered directly to customers and through reseller partnerships, contributing to the resilience of the underground proxy market even after law-enforcement disruption. Dutch authorities disrupted ASOCKS and Nexusnet, but the operation reportedly continued through resale relationships with other providers. ASOCKS has been observed at a substantially smaller scale than its public claims, with independent observation placing its active proxy population in the low hundreds of thousands rather than the many millions it advertised. Its role in the ecosystem is consistent with malicious proxy operators that both control infected-device pools and broker access obtained from partner services, allowing continuity of operations despite takedowns. This places ASOCKS within a mature cybercriminal supply chain centered on compromised consumer and edge devices and the resale of anonymized network access. The available information supports characterization of ASOCKS as a financially motivated criminal service provider involved in proxy-enabled post-compromise monetization and operational resilience through partner reselling. Specific high-confidence attribution to a nation state, source country, victim-country set, or industry targeting is not currently available.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.