DISRUPTING THE WORLD'S LARGEST RESIDENTIAL PROXY NETWORK

Summary from the TLDR InfoSec newsletter

Google Threat Intelligence Group disrupted the IPIDEA residential proxy network—believed to be the world's largest—by taking legal action against C2 domains, sharing intelligence with partners, and enforcing removals of Google Play Protect, reducing the available device pool by millions. The investigation revealed IPIDEA operated through 14+ proxy and VPN brands with four SDK families (PacketSDK, CastarSDK, HexSDK, and EarnSDK) sharing a two-tier C2 infrastructure and approximately 7,400 Tier Two servers, with over 550 threat groups from China, DPRK, Iran, and Russia observed using IPIDEA exit nodes in a single week. Organizations should monitor for published IOCs, block known IPIDEA-associated domains, and audit environments for traffic patterns consistent with residential proxy abuse, particularly from applications that monetize bandwidth.