Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)
ID: 3350e5b5-8e72-5b59-b240-685947a5c44e
STIX ID: report--3350e5b5-8e72-5b59-b240-685947a5c44e
Feed Name: ASEC
Threat Score
ASEC reports Larva-25012 resumed proxyjacking in H2 2026, actively distributing Proxyware (DigitalPulse, SOAX, Appsalt, IPRoyal) by leveraging already-infected systems and DPLoader; distribution uses obfuscated JavaScript/Python loaders and PowerShell downloaders that register Task Scheduler tasks, disable Microsoft Defender, and install SDK-based Proxyware. The report includes IoCs (MD5s, download URLs), detection names, and recommends caution when downloading executables from untrusted sites and using vendor protection.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.