Bad Sushi: China-Nexus Phishing Operation Shifts to Residential Proxy Networks

Key facts for Bad Sushi residential proxy phishing

Detection coverage for Bad Sushi residential proxy phishing

As of 2026-09-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2471 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Residential-Proxy Tier-One C2 Beacon — IPIDEA/NetNut SDK Callback (SPL)

Detects outbound DNS/HTTP(S) callbacks from managed endpoints, mobile devices, or IoT/edge devices to known IPIDEA/NetNut Tier One C2 domains (packetsdk.xyz/.net/.io, holadns.com, dispatch1.hexsdk.com) or previously observed residential-proxy exit-node IPs, indicating the device has been recruited as an exit node in the backconnect residential-proxy botnet that relays Bad Sushi phishing traffic and comparable IPIDEA/NetNut-fed campaigns.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1090.002, T1665, T1583.005, T1585.003
• Data sources: dns, firewall, network_ids_suricata, edr_network_events
• Severity: critical
• Confidence: high

Splunk SPL

index=network (sourcetype="pan:traffic" OR sourcetype="stream:dns" OR sourcetype="suricata")
| eval c2_domain_hit=if(match(query, "(?i)(packetsdk\.(xyz|net|io)|holadns\.com|hexsdk\.com|dispatch1\.hexsdk\.com)") OR match(dest_domain, "(?i)(packetsdk\.(xyz|net|io)|holadns\.com|hexsdk\.com|dispatch1\.hexsdk\.com)"), 1, 0)
| eval c2_ip_hit=if(dest_ip IN ("49.51.68.143","45.78.214.188"), 1, 0)
| where c2_domain_hit=1 OR c2_ip_hit=1
| stats count min(_time) as first_seen max(_time) as last_seen values(dest_ip) as dest_ips values(dest_domain) as c2_domains by src_ip, host
| where count > 0

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteUrl has_any ("packetsdk.xyz","packetsdk.net","packetsdk.io","holadns.com","hexsdk.com","dispatch1.hexsdk.com") or RemoteIP in ("49.51.68.143","45.78.214.188")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, RemotePort
| summarize EventCount=count(), Domains=make_set(RemoteUrl), IPs=make_set(RemoteIP) by DeviceName
| where EventCount > 0

Sigma

title: Residential-Proxy Tier-One C2 Callback (IPIDEA/NetNut SDK Infrastructure)
id: a1b2c3d4-3333-4a2b-9c3d-000000000001
status: experimental
description: Detects outbound callbacks to known IPIDEA/NetNut Tier One C2 domains and exit-node IPs, indicating a device has been recruited into the backconnect residential-proxy botnet feeding Bad Sushi and comparable phishing/fraud campaigns.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network
    - https://cloud.google.com/blog/topics/threat-intelligence/google-continued-disruption-residential-proxy-networks
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-09-12
tags:
    - attack.command-and-control
    - attack.t1090.002
    - attack.defense-evasion
    - attack.t1665
    - attack.resource-development
    - attack.t1583.005
    - attack.t1585.003
    - attack.tool.ipidea
    - attack.tool.netnut
logsource:
    category: dns
    definition: 'Requires DNS query logs or network/firewall logs capturing destination domain and IP (e.g. Suricata, PAN, EDR network events)'
detection:
    selection_domains:
        query|contains:
            - 'packetsdk.xyz'
            - 'packetsdk.net'
            - 'packetsdk.io'
            - 'holadns.com'
            - 'hexsdk.com'
    condition: selection_domains
falsepositives:
    - None expected for the exact domains listed; if extending the IP list with broader IPIDEA/NetNut exit-node ranges, shared residential IP space can occasionally include legitimate consumer traffic
level: critical

Known false positives:

• None expected for the exact domains/IPs listed; if extending the IP list with broader IPIDEA/NetNut exit-node ranges, shared residential IP space can occasionally include legitimate consumer traffic

Tuning notes: Refresh the C2 domain and exit-node IP list on a regular cadence, since Spamhaus/Bitsight/GTIG republish IOCs as IPIDEA/NetNut infrastructure churns and gets seized; extend to a full IPIDEA/NetNut Tier One domain feed rather than the static list shown here, and pivot on DeviceFileEvents/DeviceProcessEvents for PacketSDK/CastarSDK/HexSDK/EarnSDK artifacts to confirm device-level recruitment.

• 🔒 Financial Brand-Impersonation Phishing Delivery — Generic HELO Discriminator (KQL) · unlock with TL Creds
• 🔒 Phishing Redirector Click-Through to .top Domain on Alibaba/Tencent Cloud VPS (KQL) · unlock with TL Creds
• 🔒 Residential-Proxy Tier-One C2 Beacon — IPIDEA/NetNut SDK Callback (KQL) · unlock with TL Creds
• 🔒 Financial Brand-Impersonation Phishing Delivery — Generic HELO Discriminator (Sigma) · unlock with TL Creds
• 🔒 Phishing Redirector Click-Through to .top Domain on Alibaba/Tencent Cloud VPS (Sigma) · unlock with TL Creds
• 🔒 Residential-Proxy Tier-One C2 Beacon — IPIDEA/NetNut SDK Callback (Sigma) · unlock with TL Creds
• 🔒 Financial Brand-Impersonation Phishing Delivery — Generic HELO Discriminator (SPL) · unlock with TL Creds
• 🔒 Phishing Redirector Click-Through to .top Domain on Alibaba/Tencent Cloud VPS (SPL) · unlock with TL Creds

Indicators of compromise for Bad Sushi residential proxy phishing

As of 2026-09-12, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-2471.

Sample indicators (3 of 24)

• IP address: 49.51.68[.]143
• Domain: packetsdk[.]xyz
• IP address: 45.78.214[.]188

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How Bad Sushi residential proxy phishing works

Since at least February 2023, Spamhaus has tracked a China-nexus phishing operation running dedicated spam cannons out of China Telecom (Fujian branch) and China Unicom subnets, primarily targeting Japanese internet users with phishing emails impersonating financial brands SBI, JCB, and Hodaka. Listing of those subnets in the Spamhaus Blocklist (SBL) suppressed deliverability, and in early April 2025 the operator pivoted its sending infrastructure to residential proxy networks built on insecure or pre-compromised consumer/IoT devices (the same abuse model documented in Spamhaus's earlier reporting on malicious proxy SDKs bundled with apps such as Mobdro and on compromised smart doorbells).

The pivot produced an immediate and dramatic scale increase: within the same month the operation was observed churning 3.5-4 million residential-proxy IPs at a rate of roughly 250,000 IPs per day, with Spamhaus noting that source-IP geography (Latin America in particular) 'lit up in Spamhaus's systems like a Christmas tree.' By May 2025 the campaign's source geography had expanded from a single country to 173 countries, with distinct source IPs growing from approximately 4,600 to over 1.3 million spread across 8,893 distinct Autonomous Systems. Alongside the infrastructure shift, the operator changed its email tradecraft: pre-shift messages used brand-impersonating HELO strings tied to the targeted financial institutions, while post-shift traffic consistently uses generic, non-existent HELOs — a reliable discriminator for defenders. Spamhaus additionally observed the operator (and adjacent spam senders) routing messages through legitimate email-forwarding services to 'wash' phishing mail and inherit better sender reputation for deliverability. Phishing landing pages moved from shared file-hosting networks to dedicated VPS instances on Alibaba Cloud and Tencent Cloud, fronted by .top-TLD redirector domains.

The operation demonstrates active, systematic evasion: proxy IPs are discarded within minutes of being added to Spamhaus datasets, and emissions have begun shifting from IPv4 to IPv6 address space, driving a corresponding surge in IPv6 listings. As of the October 2025 Spamhaus report, residential-proxy activity attributable to this and related campaigns accounted for roughly 66% of all Exploits Blocklist (XBL) listings (3.34 million) and 37% of Combined Spam Sources (CSS) listings (1.73 million). Spamhaus separately observed a similar Brazil-nexus campaign abusing ~500,000 residential-proxy IPs for brute-force login attempts in the weeks preceding the China-nexus pivot, and noted comparable phishing activity against Taiwanese internet users, suggesting a broader trend of China-nexus and adjacent actors adopting rented residential-proxy infrastructure as a blocklist-evasion primitive. Bitsight traces the underlying malware lineage to 'backconnect' residential-proxy malware active since at least 2016.

No specific actor group or malware family is named by Spamhaus for this operation; the 'Bad Sushi' designation is the vendor's campaign label, not a confirmed threat-actor identity. The residential-proxy pools abused for delivery are themselves built and monetized by a distinct criminal ecosystem that Spamhaus, Bitsight, and Google's Threat Intelligence Group (GTIG) have separately documented as the supply chain enabling this and comparable phishing/fraud campaigns. GTIG's January 2026 disruption of the IPIDEA conglomerate (operating 13 proxy/VPN storefront brands including Luna Proxy, 922 Proxy, ABC Proxy, and IPIDEA itself, all signed with Hong Kong shell-company code-signing certificates) found over 550 distinct threat groups — including China-, DPRK-, Iran-, and Russia-nexus clusters — using IPIDEA exit nodes in a single 7-day window for SaaS access, on-premises intrusions, and password-spray attacks, backed by roughly 7,400 Tier Two C2 servers, 3,075 malicious Windows PE hashes, and 600+ compromised Android apps (PacketSDK, CastarSDK, HexSDK, EarnSDK — the last a rebrand of prior Badbox 2.0 botnet infrastructure); Google, Cloudflare, and Lumen/Black Lotus Labs jointly disrupted the Tier One C2 domains and Google Play Protect blocked the malicious SDK-bearing apps. GTIG's July 2026 follow-up disruption of the separate NetNut platform (built on the ~2-million-device Popa botnet, seized with FBI and IRS-CI involvement) found 316 distinct threat clusters using suspected NetNut exit nodes in a single week and identified NetNut botnet-plugin components shared with Badbox 2.0 — evidence that the same underlying device-compromise supply chain feeds multiple competing residential-proxy storefronts. Those entities are recorded here as sourced infrastructure context establishing the delivery mechanism's provenance, not as confirmed operators of the Bad Sushi campaign itself.

MITRE ATT&CK techniques by tactic:

Command and Control

T1090.002 External Proxy

Execution

T1204.001 Malicious Link

Initial Access

T1566.002 Spearphishing Link

Resource Development

T1583.001 Domains; T1583.003 Virtual Private Server; T1583.005 Botnet; T1585.002 Email Accounts; T1585.003 Cloud Accounts

command-and-control

T1665 Hide Infrastructure

Defense Evasion

T1684.001 Impersonation

Remediation for Bad Sushi residential proxy phishing

Immediate actions

• Block or flag inbound SMTP sessions presenting generic, non-existent, or non-resolvable HELO/EHLO strings
• Enforce SPF, DKIM, and DMARC on inbound mail flows to catch spoofed financial-brand senders
• Disable or restrict automatic forwarding rules that accept unauthenticated inbound messages
• Monitor for and block known IPIDEA/NetNut Tier One C2 domain patterns (e.g. *.packetsdk.xyz/.net/.io, holadns.com, *.hexsdk.com) as a proxy-supply-chain compromise indicator on managed endpoints

Workarounds

• Identify and disconnect residential IoT devices (smart doorbells, streaming boxes, routers) exhibiting proxy-like outbound connection patterns
• Rate-limit or geofence unexpected authentication/login traffic sourced from residential ASN space when it does not match customer geography

Longer-term hardening

• Subscribe to and act on Spamhaus XBL/CSS/SBL and ZEN (not SBL alone) feeds, since PBL/ZEN coverage catches residential-proxy-sourced traffic that SBL-only filtering misses
• Deploy egress monitoring for residential-proxy SDK / proxyware traffic patterns on managed endpoints and IoT device fleets
• Educate Japanese financial-brand customers (SBI, JCB, Hodaka) on current lure patterns and .top-domain redirector abuse
• Audit mobile fleets for applications bundling known proxy SDKs (PacketSDK, CastarSDK, HexSDK, EarnSDK) and rely on Google Play Protect enforcement signals

Affected and fixed versions

• SBI — SBI online banking customers (brand impersonation, not a software vulnerability)
• JCB — JCB payment-card customers (brand impersonation, not a software vulnerability)
• Hodaka — Hodaka customers (brand impersonation, not a software vulnerability)

Timeline of Bad Sushi residential proxy phishing

• 2016-01-01 Bitsight documents 'backconnect' residential-proxy malware active since at least 2016, establishing the technical lineage for today's residential-proxy-as-a-service platforms.
• 2021-10-19 Spamhaus documents smart doorbells and other IoT devices being compromised via malicious proxy SDKs bundled in apps such as locked-ioc-18, seeding the residential-proxy ecosystem later abused for phishing distribution.
• 2022-05-25 Spamhaus publishes a primer on the dangers of residential proxy networks, describing SDK-based device recruitment and its abuse for spam and network-penetration.
• 2023-02-01 Spamhaus begins listing locked-ioc-3 and locked-ioc-12 subnets dedicated to phishing emissions in the Spamhaus Blocklist (SBL).
• 2025-04-01 The China-nexus phishing operation ('Bad Sushi') shifts its distribution infrastructure from dedicated China Telecom/Unicom subnets to residential proxy networks, deploying 3.5-4 million IPs with roughly 250,000 IPs churned daily; source-IP geography including Latin America surges.
• 2025-04-01 A separate Brazil-nexus campaign is observed abusing roughly 500,000 residential-proxy IPs for widespread brute-force login attempts, shortly before the China-nexus pivot.
• 2025-05-01 Campaign source geography expands from a single country (Japan) to 173 countries; distinct source IPs grow from approximately 4,600 to over 1.3 million across 8,893 distinct Autonomous Systems.
• 2025-07-01 Badbox/Badbox 2.0, Android supply-chain malware that fed residential-proxy device pools, is disrupted.
• 2025-10-16 Spamhaus publishes 'Bad sushi: China-nexus phishers shift to residential proxies,' documenting the campaign; residential-proxy activity by this point accounts for roughly 66% of XBL listings (3.34M) and 37% of CSS listings (1.73M).
• 2025-12-01 The locked-ioc-16 botnet is documented infecting more than two million Android TV streaming devices via bundled residential-proxy software, expanding the pool of abusable proxy infrastructure.
• 2026-01-28 Google Threat Intelligence Group (GTIG) publishes a disruption report on the locked-ioc-19 conglomerate (Luna Proxy/922Proxy/IP2World/ABC Proxy and 9 other brands): over 550 distinct threat groups from China, DPRK, Iran, and Russia used locked-ioc-19 exit nodes in a single 7-day window; GTIG identifies ~7,400 Tier Two C2 servers, 3,075 malicious Windows PE hashes, and 600+ compromised Android apps carrying PacketSDK/CastarSDK/HexSDK/EarnSDK; Cloudflare disrupts domain resolution and Google Play Protect blocks the malicious SDK-bearing apps, reducing locked-ioc-19's device pool by millions.
• 2026-03-12 The FBI and IC3 publish a public service announcement warning device owners about residential-proxy network recruitment and abuse.
• 2026-06-01 In a single week during June 2026, GTIG observes 316 distinct threat clusters, including cybercriminal and espionage groups, using suspected locked-ioc-20 exit nodes; locked-ioc-20's network is estimated at 2 million-plus devices with botnet-plugin components shared with Badbox 2.0.
• 2026-07-02 FBI, Google, Lumen, Shadowserver, and IRS Criminal Investigation seize the locked-ioc-20 residential-proxy platform, built on the roughly two-million-device locked-ioc-14; Google separately disables Google accounts/services used for locked-ioc-20 C2 and Play Protect disables apps carrying locked-ioc-20 SDKs.

Sources cited for Bad Sushi residential proxy phishing

• Evading Residential Proxy Networks: Protecting Your Devices from Becoming a Tool for Criminals fbi.gov · Advisory · 2026-03-12
• Bad sushi: China-nexus phishers shift to residential proxies spamhaus.org · Vendor report · 2025-10-16
• Let's talk about the danger of residential proxy networks spamhaus.org · Vendor report · 2026-02-03
• When doorbells go rogue! spamhaus.org · Vendor report · 2021-10-19
• Residential Proxy Services and Malware Ecosystems bitsight.com · Research · 2026-05-07
• Disrupting the Largest Residential Proxy Network Google Cloud · Vendor report · 2026-01-28
• Google's Continued Disruption of Malicious Residential Proxy Networks Google Cloud · Vendor report · 2026-07-02
• Bad sushi: China-nexus phishers shift to residential proxies (syndication) securityboulevard.com · Blog · 2025-10-17
• FBI Seizes NetNut Proxy Platform, Popa Botnet Krebs on Security · News · 2026-07-02
• To stop crims, Google starts dismantling residential proxy network they use to hide The Register · News · 2026-01-29

More in phishing

• Fraudulent Shopify Stores Running 'Outsider'-Linked Phishing Kits (Outsider/JWR and Playswing)
• Bad Sushi: China-nexus phishing operations shift to residential proxy networks (Japan/Taiwan targeting)
• ChatGPT Plus Billing Phishing Kit Uses Rotating WordPress Sites to Steal Payment Details and OTPs
• Town of Whitsett, NC Microsoft 365 Account Compromise Used to Send Fake Payment Phishing Email
• Operation Fake KickOff: Recruiter-Impersonation AitM Phishing Abusing SaaS to Harvest Work Credentials