Loading malware…
GhostSocks is a Go-based SOCKS5 backconnect proxy malware sold as a Malware-as-a-Service offering and closely associated with the LummaC2 infostealer ecosystem. It is designed to convert compromised systems into residential proxy nodes so threat actors can route traffic through victim devices, making malicious activity appear to originate from legitimate home or office connections. The malware has been advertised on Russian-language cybercrime forums since 2023 and later expanded into broader criminal distribution ecosystems, including fake software installers and trojanized GitHub repositories themed around popular AI and developer tools.
GhostSocks primarily targets Windows systems, with reporting also indicating Linux support. It uses a relay-based command-and-control architecture in which infected hosts register with helper infrastructure and receive relay information used to establish SOCKS5 backconnect tunnels. Newer variants have been observed using HTTPS and wrapping relay traffic in TLS, improving stealth and resilience. Samples contain embedded, obfuscated configuration data including proxy credentials, build metadata, and command-and-control information, and can receive updated infrastructure after initial check-in.
Beyond proxying, GhostSocks includes backdoor functionality. Documented capabilities include arbitrary command execution, modification of SOCKS5 credentials, and download-and-execute of additional payloads. Later variants also added persistence on Windows through run-key mechanisms. Anti-analysis and obfuscation features have been reported, including anti-sandbox checks and heavily obfuscated Go builds.
GhostSocks is frequently deployed alongside credential-stealing malware, especially LummaC2 and Vidar, in campaigns using fake installers, trojanized repositories, and other deceptive software lures. Its integration with LummaC2 allows operators to provision reverse proxy binaries onto infected hosts, enabling post-compromise abuse such as operating from the victim’s IP and device context. This can help bypass anti-fraud controls, same-device fingerprinting, and some session or cookie-based trust checks. Reporting has also linked GhostSocks use to broader criminal operations, including activity associated with Black Basta.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
For web searches such as “DeepSeek v4 weights GitHub,” the malicious repository and its forks were positioned among top results, at times appearing ahead of official references like the Hugging Face release page.
GhostSocks executes this command with PowerShell, which means defenders should be on the lookout for the above command string as it could be indicative of a GhostSocks infection.
Arbitrary Command Execution ( shell , ID: 5): Executes arbitrary commands sent by the C2: cmd.exe /C <command>
MITRE ATT&CK Mapping Technique Mapping Evidence T1106 Native API Native DLL loaded via Electron FFI.
The above-mentioned GhostSocks sample is heavily obfuscated at points, likely making use of the popular open-source Go obfuscator Garble... Along with some features from Gofuscator such as inline XOR-based string deobfuscation.
MITRE ATT&CK Mapping Technique Mapping Evidence T1036 Masquerading Fake WinDirStat and LightShot apps.
After GhostSocks assembles its JSON configuration dictionary, it encrypts the dictionary with XOR using the key “config” and sends it to one of the C2s contained in its hardcoded C2 list in a basic request... While older samples communicate over HTTP, newer samples have been spotted leveraging HTTPS...
GhostSocks uses a fairly simple relay-based C2 implementation using a simple HTTP API... Upon a victim first connecting to the C2, GhostSocks starts to build the HTTP GET query parameters... and a X-Api-Key header required for all requests to the C2.
MITRE ATT&CK Mapping Technique Mapping Evidence T1090 Proxy Backconnect/proxy strings and yamux-based session code.
GhostSocks , a Golang-based SOCKS5 backconnect proxy malware... The addition of a SOCKS5 backconnect feature... allows threat actors to use the compromised system as a relay... GhostSocks initiates a TCP connection to this Tier 1 node. SOCKS5 Tunnel Creation – The malware sets up a SOCKS5 proxy tunnel
Download & Execute Arbitrary Executables ( update , ID: 6) Download an arbitrary executable, execute it using the same code used for the shell command
The configuration is then encoded into a JSON object, obfuscated, and written to %APPDATA%\config.
119 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
30 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Golang-based SOCKS5 backconnect proxy malware sold as a MaaS offering. It establishes a TCP connection to attacker-controlled relay infrastructure, creates a SOCKS5 tunnel through the infected host, and enables threat actors to route traffic via the victim's IP to bypass geolocation and anti-fraud controls. It also includes backdoor capabilities such as arbitrary command execution, credential modification, and download-and-execute functionality.
Mentioned only as an example of another malware family that uses SOCKS5 traffic.
Additional downstream payload documented in related research as part of the broader fake-AI lure ecosystem alongside Vidar.
Additional downstream malware documented by external research as part of the broader fake-AI lure ecosystem alongside Vidar.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.