As reported by The Hacker News, researchers at Infoblox have pulled back the curtain on a sophisticated and long-running threat actor dubbed Lurking Lizard — an operation that has been quietly building a commercial residential proxy network by hijacking everyday consumer and business devices through trojanized software installers, including convincing fakes of the popular 7-Zip utility.

Threat Alert: At first glance, a residential proxy scheme might seem like a nuisance-tier threat — far removed from ransomware or nation-state espionage.

Why This Threat Is More Dangerous Than It Looks

At first glance, a residential proxy scheme might seem like a nuisance-tier threat — far removed from ransomware or nation-state espionage. That framing is dangerously wrong. Residential proxy networks sit at the foundation of the modern cybercriminal economy. They are the infrastructure layer that makes credential stuffing, ad fraud, CAPTCHA bypass, web scraping, and even targeted attacks operationally viable — and nearly impossible to block using traditional IP reputation tools.

When attackers route malicious traffic through a real residential IP address belonging to an unwitting homeowner or a small business employee, that traffic inherits the trust that legitimate ISP-assigned addresses carry. Security controls that rely on IP reputation, geolocation-based allow-listing, or behavioral baselines built around "normal" residential traffic are systematically undermined.

"The victim's device isn't just compromised — it becomes complicit in attacks against third parties, often without triggering a single alert on the host system."

The Lurking Lizard Playbook

What distinguishes this operation from opportunistic malware campaigns is its vertical integration. Lurking Lizard isn't simply distributing malware — it has constructed an end-to-end business: lookalike domains to drive traffic, trojanized installers to deliver the payload, and presumably a monetization layer where proxy bandwidth is resold to paying customers, including other criminal groups. The use of over 230 typosquatted or lookalike domains signals serious investment in infrastructure longevity and redundancy — this is not a smash-and-grab operation.

The choice of 7-Zip as a lure is tactically shrewd. The tool is ubiquitous in both enterprise and home environments, frequently downloaded outside of managed software channels, and rarely scrutinized for authenticity. Many organizations allow employees to self-install utilities like archive managers, creating a significant exposure window that endpoint controls may not fully cover.

Who Is Most at Risk

The Lurking Lizard Playbook
Remote workers and home office users who download software independently from search engines rather than corporate portals
Small and mid-sized businesses without centralized software distribution or application allowlisting controls
Organizations with BYOD policies where device management visibility is limited
Any company that has not deployed DNS-layer filtering capable of detecting lookalike domains in real time

The Broader Residential Proxy Ecosystem Problem

Lurking Lizard is a symptom of a larger market failure. Residential proxy services — even legitimate commercial ones — operate in a regulatory gray zone, and the line between a "consented" proxy node and a silently enrolled victim device is routinely blurred or outright fabricated. Criminal operations like this one exploit that ambiguity, making attribution and takedown genuinely difficult. Law enforcement and hosting providers struggle to distinguish malicious proxy traffic from legitimate use at scale.

The fact that this campaign has operated since at least August 2022 — nearly three years — without disruption underscores how resilient these operations are once they achieve infrastructure maturity. Each new victim device extends the network's utility and geographic diversity, making the proxy pool progressively more valuable and harder to denylist.

Shield53 Recommendations

Immediate Actions

  • Audit software installation policies: Restrict end-user ability to download and install executables from unmanaged sources. Enforce application allowlisting where possible, particularly for commonly abused utilities like archive managers and remote access tools.
  • Deploy DNS-layer protection: Solutions capable of detecting lookalike and typosquatted domains in real time (such as those using ML-based domain similarity analysis) are your first line of defense against this delivery mechanism.
  • Verify installer integrity: Mandate cryptographic signature verification for all software installations. Legitimate tools like 7-Zip publish official hashes — train users and IT staff to check them.
  • Hunt for anomalous outbound traffic: Compromised proxy nodes generate persistent, low-volume outbound connections to command infrastructure. Review NetFlow data and endpoint telemetry for unusual long-lived connections or unexpected SOCKS/HTTP proxy behavior.
  • Check your threat intelligence feeds: Cross-reference the 230+ known Lurking Lizard domains (via Infoblox's published research) against your DNS query logs, firewall logs, and proxy logs going back at least 90 days.
  • Educate high-risk user groups: Remote workers and power users who routinely self-install utilities need targeted awareness training on verifying download sources.

Longer-Term Posture

Organizations should revisit their acceptable use and software procurement policies as part of a broader supply chain hygiene initiative. The shift toward work-from-home has permanently expanded the attack surface for this class of threat. Without centralized visibility into what software is being installed on endpoints — especially those operating outside corporate network perimeters — campaigns like Lurking Lizard will continue to find fertile ground.