Loading malware…
GhostSocks is a Golang-based SOCKS5 backconnect proxy malware offered as a malware-as-a-service product and marketed on Russian-language criminal forums since 2023. It compromises Windows and Linux systems and converts them into residential proxy nodes, allowing operators to route traffic through a victim’s network connection and operate using the victim’s IP address and device context. GhostSocks is closely integrated with the Lumma information-stealer ecosystem: Lumma operators can provision GhostSocks on infected hosts through their administration tooling, enabling post-compromise proxy access that can assist abuse of sessions and services protected by IP- or device-based controls.
GhostSocks uses a relay-based command-and-control architecture. The malware registers with controller infrastructure, receives relay details, and establishes SOCKS5 backconnect tunnels from infected systems. Recent variants wrap relay traffic with TLS, while configurations and communications are obfuscated to hinder inspection. Samples employ anti-analysis checks and code obfuscation, and some builds establish Windows startup persistence. In addition to proxying, GhostSocks includes backdoor functionality for arbitrary command execution, changing proxy credentials, and downloading and executing additional payloads.
GhostSocks has been deployed as a secondary payload alongside Vidar and Lumma in campaigns using trojanized software archives, including fake repositories and installers themed around popular AI tools and other software. These campaigns use deceptive download lures and search-result manipulation to induce victims to execute droppers that install both credential-stealing malware and GhostSocks. The resulting proxy infrastructure can conceal subsequent criminal activity and support further post-compromise operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Malware actors were playing a fourth game: opportunistic distribution. Fake repositories dressed as leaked Claude Code delivered Vidar v18.7 and GhostSocks to anyone who downloaded them.
MITRE ATT&CK TTPs ... Resource Development Establish Accounts: Social Media Accounts T1585.003 Disposable GitHub accounts for distribution
For web searches such as “DeepSeek v4 weights GitHub,” the malicious repository and its forks were positioned among top results, at times appearing ahead of official references like the Hugging Face release page.
GhostSocks executes this command with PowerShell, which means defenders should be on the lookout for the above command string as it could be indicative of a GhostSocks infection.
Arbitrary Command Execution ( shell , ID: 5): Executes arbitrary commands sent by the C2: cmd.exe /C <command>
MITRE ATT&CK Mapping Technique Mapping Evidence T1106 Native API Native DLL loaded via Electron FFI.
The above-mentioned GhostSocks sample is heavily obfuscated at points, likely making use of the popular open-source Go obfuscator Garble... Along with some features from Gofuscator such as inline XOR-based string deobfuscation.
MITRE ATT&CK Mapping Technique Mapping Evidence T1036 Masquerading Fake WinDirStat and LightShot apps.
After GhostSocks assembles its JSON configuration dictionary, it encrypts the dictionary with XOR using the key “config” and sends it to one of the C2s contained in its hardcoded C2 list in a basic request... While older samples communicate over HTTP, newer samples have been spotted leveraging HTTPS...
GhostSocks uses a fairly simple relay-based C2 implementation using a simple HTTP API... Upon a victim first connecting to the C2, GhostSocks starts to build the HTTP GET query parameters... and a X-Api-Key header required for all requests to the C2.
MITRE ATT&CK Mapping Technique Mapping Evidence T1090 Proxy Backconnect/proxy strings and yamux-based session code.
MITRE ATT&CK TTPs ... Command and Control Proxy: Multi-hop Proxy T1090.003 GhostSocks SOCKS5 proxy
Download & Execute Arbitrary Executables ( update , ID: 6) Download an arbitrary executable, execute it using the same code used for the shell command
The configuration is then encoded into a JSON object, obfuscated, and written to %APPDATA%\config.
123 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
32 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A SOCKS5 proxy malware deployed alongside Vidar that tunnels network traffic through the victim machine, allowing operators to use compromised hosts as residential proxies.
Golang-based SOCKS5 backconnect proxy malware sold as a MaaS offering. It establishes a TCP connection to attacker-controlled relay infrastructure, creates a SOCKS5 tunnel through the infected host, and enables threat actors to route traffic via the victim's IP to bypass geolocation and anti-fraud controls. It also includes backdoor capabilities such as arbitrary command execution, credential modification, and download-and-execute functionality.
Mentioned only as an example of another malware family that uses SOCKS5 traffic.
Additional downstream payload documented in related research as part of the broader fake-AI lure ecosystem alongside Vidar.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.