Anyproxy
Anyproxy is identified in the provided content as a cybercriminal service associated with a botnet that was dismantled during Operation Moonlander. It is mentioned alongside 5socks and other botnet-backed criminal services that have faced law-enforcement scrutiny since 2021. The content directly states that Operation Moonlander dismantled the botnet behind the Anyproxy and 5socks services. No additional high-confidence technical details about Anyproxy’s malware family, infection chain, capabilities, targeted platforms, victimology, associated threat actor, or indicators of compromise are provided in the supplied material.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
1 distinct technique documented for this family, organized by ATT&CK tactic.
Command and Control
1 technique
Command and Control
One of the techniques used is setting up proxy servers on infected systems to tunnel traffic outside the enterprise to the infected hosts using tools such as Stowaway ... UAT-8302 may use other tools such as anyproxy to set up proxies within the infected enterprise’s network
IOCs tracked for this family
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as a botnet that has faced law enforcement scrutiny since 2021.
Referenced as a proxy/botnet service that has faced law enforcement scrutiny since 2021.
Botnet/service referenced as being dismantled in Operation Moonlander.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.