Ngioweb is a residential-proxy botnet, now predominantly Linux and IoT, that enrols compromised SOHO routers and IoT devices as proxy nodes. Lumen’s Black Lotus Labs reported in November 2024 that Ngioweb is the principal bot source for the NSOCKS criminal residential-proxy service, supplying at least 80% of NSOCKS bots and sustaining a daily average of roughly 35,000 working bots across about 180 countries. Trend Micro profiled the operator as Water Barghest, describing a highly automated exploit-to-monetisation pipeline that lists a freshly compromised device on a residential-proxy marketplace in as little as ten minutes.
Overview & Timeline
- Aug 2018. Ngioweb first documented by Check Point, originally a Windows threat tied to a Ramnit campaign.
- 2023. The IoT residential-proxy operation is observed at scale; Water Barghest activity traced after the actor targeted an edge-device vulnerability.
- Oct 2024. Trend Micro counts the botnet at more than 20,000 IoT devices.
- Nov 2024. Lumen and Trend Micro publish; Lumen, with the Shadowserver Foundation, moves to disrupt Ngioweb and NSOCKS infrastructure.
How It Works
- Automated exploitation: around 17 worker machines on VPS continuously scan internet-scan databases such as Shodan and exploit known vulnerabilities in outdated routers, cameras and NAS devices from vendors including Cisco, DrayTek, FRITZ!Box, Netgear, Synology, Tenda, Western Digital and Zyxel. T1595.002 T1190
- Memory-resident: on IoT devices the Ngioweb payload runs in memory and connects out to register as a proxy, reducing on-disk footprint. T1105
- Tiered infrastructure: a loader network separate from the proxy C2, separate again from the NSOCKS back-connect that sells access — adding resilience and complicating takedown. T1090.003
Specific CVE identifiers for the Zyxel, Reolink and other targeted devices were not enumerated in the public reporting reviewed; they are described here as known n-day vulnerabilities rather than cited by number.
Monetization
NSOCKS rents proxies by the day, paid in cryptocurrency, and succeeds the earlier LuxSocks service. Buyers use it for reconnaissance, fraud, credential stuffing and spam. Ngioweb also feeds the VN5Socks and Shopsocks5 services. A verified per-day price was not available and is not stated here.
MITRE ATT&CK Mapping
Analyst-mapped; Ngioweb has no official ATT&CK Software entry.
| Tactic | Technique | Usage |
|---|---|---|
| Reconnaissance | T1595.002 Vulnerability Scanning | VPS workers scanning Shodan targets |
| Initial Access | T1190 Exploit Public-Facing Application | n-day exploitation of edge devices |
| Command and Control | T1090.003 Multi-hop Proxy | Residential-proxy relaying |
| Resource Development | T1583.003 Virtual Private Server | Scanner and worker VPS |
| Command and Control | T1105 Ingress Tool Transfer | Loader-C2 delivering Ngioweb |
Detection & Mitigation
- Patch and update edge and IoT firmware and retire end-of-life devices — the botnet specifically targets outdated hardware.
- Disable unnecessary remote and web-management interfaces and restrict management planes to trusted networks.
- Monitor edge devices for proxy-like relaying and memory-resident processes with no firmware provenance; block Lumen-published infrastructure where available; segment IoT from sensitive networks.
Secure Your Edge and IoT
Mjolnir Security helps organisations find compromised edge devices and the proxy botnets that recruit them.
- Attack Surface Management Finding exposed, outdated edge and IoT devices before they are recruited.
- Managed Detection and Response Monitoring for proxy-relay behaviour and exploitation of management interfaces.
- 24/7 Incident Response Containment when edge-device compromise is detected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts