Inside CanOworms: The 633-Server Proxy Network Hiding Criminal and State-Linked Activity

SecurityScorecard STRIKE mapped a 633-node anonymization/proxy-for-hire network named CanOworms that routes malicious campaigns for diverse customers—including commodity malware families (Remcos, Quasar, NanoCore, NetWire, AsyncRAT, Loki) and suspected state-linked actors—across unrelated hosting providers and countries to evade blocklists and attribution; the team identified members using a shared self-signed TLS certificate corroborated with JARM and JA4X fingerprints, observed live attack-shaped traffic (credential spraying-like SSH activity targeting edge devices), and published the certificate and TLS fingerprints as indicators while warning defenders that IP-based controls have limited effectiveness against this disposable, rented infrastructure.