'Water Barghest' Sells Hijacked IoT Devices for Proxy Botnet Misuse

Water Barghest is a cybercriminal operation that has automated the compromise of Internet-facing IoT and SOHO routers—using Ngioweb malware and public scanning services—to register devices as proxies and sell them on residential proxy marketplaces; the group has compromised over 20,000 devices across a five-year, highly automated campaign, enabling other threat actors to anonymize scraping, access, and attacks.