Loading threat actor…
G3Proxy is a malicious residential proxy botnet and proxy service associated with the broader ecosystem of criminal proxy networks built from compromised consumer devices. It initially spread through preinfected Android TV boxes and later expanded through Android APK-based infections in 2026. At peak scale, it exceeded 1 million victim IP addresses per day, making it one of the larger botnet-backed proxy services observed in this ecosystem. The operation monetizes access to infected devices by routing third-party traffic through victim residential connections, a model commonly used to support anonymity, fraud enablement, and other downstream criminal activity. G3Proxy is part of a resilient supply chain in which operators may both maintain their own botnets and participate in proxy resale relationships with other services. Following disruption activity against IPIDEA, G3Proxy shifted its command-and-control infrastructure into Chinese IP space, aligning it with a broader cluster of proxy botnets assessed to be operated by Chinese actors. These services have been noted for systematically excluding mainland China from their proxy pools. Known tactics and behaviors directly associated with G3Proxy include initial access through supply-chain-style device compromise and malicious Android application distribution, persistence on infected Android-based devices, command-and-control operation for proxy enablement, and post-compromise use of victim systems as externally accessible proxy nodes. Its dominant motivation is financial, centered on selling or brokering access to compromised residential connectivity.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Attributed origin per open-source reporting.
4 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.