Loading threat actor…
Kookeey is a large malicious residential proxy service and botnet cluster assessed to be operated by Chinese actors. It has been observed at roughly 1.5 to 2 million compromised IP addresses per day, placing it among the larger proxy botnets in the criminal proxy ecosystem. The service relies on compromised Android devices and has been associated with silent APK installation to build and maintain its proxy pool. Like other major malicious proxy providers, it appears to function within a broader supply chain in which operators may both control infected devices directly and resell proxy access. Kookeey infrastructure has been linked to criminal operations beyond simple proxy resale. Its proxies have been used to support brute-force activity against Microsoft login services, indicating use for password spraying and related initial-access operations. It has also been used by a Vietnam-based fraud actor to validate and monetize stolen payment card data, showing utility for fraud enablement and traffic obfuscation. The broader ecosystem in which Kookeey operates is characterized by resilient, large-scale abuse of compromised consumer devices, especially Android endpoints, and by operational practices consistent with Chinese-operated proxy services, including exclusion of mainland China from victim pools.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.