Loading threat actor…
NSOCKS, also referred to as Ngioweb, is a malicious residential proxy service associated with the broader criminal ecosystem built on compromised edge and consumer devices. It has been linked to proxy monetization using infected infrastructure and appears to have remained operational despite prior disruption efforts by adapting its business model and backend operations. After being disrupted in 2024, NSOCKS persisted by reselling proxy access sourced from other malicious proxy providers, including NetNut and IPIDEA, demonstrating a resilient supply-chain model in which operators both control their own botnets and broker access to third-party compromised devices. NSOCKS has also been observed using a domain generation algorithm to manage command-and-control infrastructure, indicating continued investment in resilience and defense evasion. The actor is best characterized as part of the cybercriminal residential-proxy ecosystem rather than a nation-state intrusion set.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
5 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.