What Is Proxyware and Why Attackers Install It

Proxyware is software that turns a computer into an exit node for other people's internet traffic. Some people install it on purpose and get paid for sharing their bandwidth. Attackers install it on servers they have broken into and sell access to the victim's IP address. The October 2026 Plex2Shell attacks on Plex Media Server are a current example: hijacked servers ran a miner and a proxy side by side.

What is proxyware?

Proxyware is a program that accepts connections from a remote service and forwards them out through the host's own network connection. To any website on the other end, the traffic appears to come from the victim's IP address.

Legitimate bandwidth-sharing apps work the same way. The difference is consent. When the software arrives through an exploit, the owner never agreed to carry anyone's traffic, and the operator keeps all the revenue.

How does a proxyware botnet make money?

Operators sell access to their pool of exit nodes as a "residential" or "unblockable" proxy service. Buyers pay because traffic from home broadband and small business connections is less likely to be blocked than traffic from a data center.

The buyers are the problem. Residential proxies are used for credential stuffing, scraping, ad fraud, account creation at scale and hiding the source of intrusion attempts. Every one of those requests leaves a log entry that points at the infected host's IP address.

In the Plex2Shell case, the proxy binary myawesomeproxy printed a notice that running it "makes you agree to the potential external use of your internet traffic." That consent text means nothing when an attacker installed the binary. The Hacker News reported that the miner's server domain shares infrastructure with a subdomain Bitsight linked to the AISURU DDoS and proxyware botnet.

Why attackers pair proxyware with miners

Attackers who land on a box tend to monetize it two ways at once:

• Cryptominers spend the CPU. They are noisy: the fans spin up, power use rises, and performance drops while nothing else seems to be running.
• Proxyware spends the network connection and the IP address's reputation. It uses little CPU, so it often keeps running after an owner notices and kills the miner.

That pairing changes how you clean up. Finding and removing the miner is not the end of the job. If the persistence mechanism survives, both come back. In Plex2Shell, the persistence was a library in the Codecs folder that loaded on every transcode. Our guide on how to check a Plex server for compromise walks through finding it. The same logic applies to Windows hosts, covered in how to detect a hidden cryptominer on a Windows server.

What does proxyware cost the victim?

The bandwidth bill is the smallest part. The real costs are:

• IP reputation. Your public address lands on blocklists after the proxy customers abuse it. Email deliverability, VPN partners and SaaS providers with IP allowlists can all be affected.
• Attribution. Abuse reports, and sometimes law enforcement requests, arrive at your door because the traffic came from your address.
• Lateral exposure. The proxy creates a tunnel into a host inside your network. Depending on the build, it may accept connections back toward internal addresses.
• A foothold. VirusTotal classified the Plex2Shell proxy as a backdoor as well as a reverse proxy. Assume the operator can run other code on the host.

How do you detect proxyware on a network?

Look for a host making many long-lived outbound connections to a small set of relay servers, with traffic volume that does not match what the host is meant to do. Then confirm on the host by finding the process that owns those connections.

Useful signals:

• Outbound sessions from a server role that should only receive connections, such as a media server, NAS or camera recorder.
• Sustained upload traffic at night or during idle periods.
• DNS lookups for proxy or relay domains, such as the proxystream.st names in the Plex2Shell reports.
• Unknown child processes under a service account. Proxyware usually runs as whichever account the exploit landed in.
• Abuse complaints or blocklist hits against an IP address that serves only a few internal users.

How do you remove it?

Kill the process only after you have recorded what it is, what it connects to and how it starts. Then find the persistence and remove it, or rebuild the host. When the entry point was a remote code execution flaw, rebuild from clean media rather than trying to scrub the old install. Patch the entry point before reconnecting the host, and close the inbound exposure that let the attacker in.

Finally, rotate anything the compromised account could read. The proxy operator had the same access as the service it hijacked.

For why a set of individually modest bugs got far enough to install this software, see why vulnerability chaining beats CVSS scores in triage.