Socks5Systemz is a long-lived Windows proxy botnet that turns infected PCs into SOCKS5 exit nodes sold through an illicit residential and anonymous-proxy service. Bitsight, which named it after the login panel on its C2 servers, assesses it has existed since 2013, operating for roughly a decade as a SOCKS5 proxy module bundled inside other malware before emerging in 2023 as a standalone botnet powering the commercial service PROXY.AM. It is distributed largely through pay-per-install loaders — PrivateLoader and Amadey — and, after a 2023–2024 infrastructure disruption, continued under the name ProxyBox.
Overview & Timeline
- 2013. Bitsight dates the proxy code to 2013, riding inside families such as Andromeda, SmokeLoader and Trickbot.
- Sep–Nov 2023. Standalone campaigns begin; Bitsight’s first analysis estimates around 10,000 infected systems and maps at least 53 European-hosted C2 servers.
- Dec 2023 – early 2024. Operators lose control of the V1 infrastructure, which is sinkholed.
- Dec 2024. Bitsight documents the PROXY.AM service.
- 2025. The operation continues, rebranded as ProxyBox.
Published bot counts conflict and are not directly comparable: around 10,000 systems (Bitsight, Nov 2023), a peak daily average near 250,000 (Synthient and later Bitsight, Jan 2024), and an “85,000+” figure in Dec 2024 press. Treat them as a sourced range across different dates and methods.
How It Works
- Delivery: not self-propagating and not CVE-driven; installed by pay-per-install loaders, chiefly PrivateLoader and Amadey. T1105
- Payload: a roughly 300 KB Windows DLL that persists via a Windows service (Bitsight reports the name
ContentDWSvc) and generates a client ID from the Windows-directory creation date. T1543.003 - C2 resilience: a domain generation algorithm locates and connects to C2; once registered, the host serves as a SOCKS5 proxy exit node. T1568.002 T1090.002
Monetization
PROXY.AM marketed “elite, private and anonymous” proxy servers, with advertised tiers reported from roughly $126 per month up to $700 per month (as marketed, not independently tested). There is no mining or data-theft purpose — the monetisation is selling access to the infected machines’ network connections.
MITRE ATT&CK Mapping
Analyst-mapped; Socks5Systemz has no official ATT&CK Software entry.
| Tactic | Technique | Usage |
|---|---|---|
| Command and Control | T1090.002 External Proxy | Victim as SOCKS5 exit node |
| Command and Control | T1568.002 Domain Generation Algorithms | C2 resolution |
| Persistence | T1543.003 Windows Service | ContentDWSvc |
| Command and Control | T1105 Ingress Tool Transfer | Loader delivery of proxy DLL |
Detection & Mitigation
- Alert on DGA-like DNS behaviour (many NXDOMAIN lookups then one resolving C2) and on the
ContentDWSvcservice. - Hunt for the PrivateLoader and Amadey precursor infections that deliver it; block cracked-software vectors.
- Watch for hosts acting as SOCKS proxies — outbound connections on behalf of many unrelated destinations not tied to user activity.
Detect Proxy-Botnet Infections
Mjolnir Security helps organisations find and remove proxy-botnet infections and the loaders that seed them.
- Managed Detection and Response Monitoring for proxy-relay traffic, DGA C2 and loader-family precursors.
- Threat Hunting as a Service Hunting for PrivateLoader and Amadey footholds and SOCKS5 proxy behaviour.
- 24/7 Incident Response Containment and cleanup when proxy-botnet activity is detected. Call +1 833 403 5875.
Stay ahead of emerging threats. Get notified when we publish new intelligence reports and advisories.
Subscribe to Alerts