The evolution and abuse of proxy networks

This report outlines the growing abuse of proxy and proxyware networks—built from compromised SOHO routers, NAS, and IoT devices—by criminal and state-sponsored actors (e.g., VPNFilter, Cyclops Blink, Mirai-like botnets) to anonymize operations, conduct espionage, and launch large-scale attacks; it highlights recent enforcement actions (FBI takedown linked to China/Volt Typhoon), common exploitation methods (N-day vulnerabilities, weak credentials), and recommends stronger patching, credential hygiene, identity/behavioral controls, and managed-device enforcement.