Residential Proxy SDKs Embedded in Everyday Apps Expose Users and Enterprises (IPIDEA, Bright Data partners)

Key facts for IPIDEA residential proxy SDKs

Detection coverage for IPIDEA residential proxy SDKs

As of 2026-10-30, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4789 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: IPIDEA Residential Proxy SDK Tier One C2 DNS Check-in

Endpoint DNS queries to Packet/Castar/Hex SDK Tier One domains (packetsdk.io/.net/.xyz incl. api-seed subdomains, hexsdk.com, dispatch1.hexsdk.com, castarsdk.com, hash-named .com domains). Tier One servers receive device diagnostics and return the Tier Two proxy node list, so a hit identifies a device enrolled as a residential proxy exit node (GTIG, TL-2026-4789).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1090, T1665
• Data sources: sysmon:EventCode22 (index=sysmon), Windows DNS server (DnsEvents), sysmon dns_query
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 earliest=-24h@h
| eval qn=lower(QueryName)
| where match(qn, "(^|\.)(packetsdk\.io|packetsdk\.net|packetsdk\.xyz|hexsdk\.com|castarsdk\.com)$") OR match(qn, "^(cfe47df26c8eaf0a7c136b50c703e173|8b21a945159f23b740c836eb50953818|31d58c226fc5a0aa976e13ca9ecebcc8|00857cca77b615c369f48ead5f8eb7f3)\.com$")
| stats count min(_time) as first_seen max(_time) as last_seen dc(QueryName) as distinct_domains values(QueryName) as queried_domains by host, Image, User
| eval first_seen=strftime(first_seen, "%F %T"), last_seen=strftime(last_seen, "%F %T")
| table host Image User queried_domains distinct_domains count first_seen last_seen

Microsoft KQL

let tier1 = @"(^|\.)(packetsdk\.io|packetsdk\.net|packetsdk\.xyz|hexsdk\.com|castarsdk\.com)$|^(cfe47df26c8eaf0a7c136b50c703e173|8b21a945159f23b740c836eb50953818|31d58c226fc5a0aa976e13ca9ecebcc8|00857cca77b615c369f48ead5f8eb7f3)\.com$";
DnsEvents
| where TimeGenerated > ago(24h)
| where tolower(Name) matches regex tier1
| summarize Queries=count(), Domains=make_set(Name, 20), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ClientIP, Computer
| order by Queries desc

Sigma

title: Residential Proxy SDK Tier One C2 Domain DNS Query (IPIDEA Packet/Castar/Hex)
id: 7c1e2b54-3a0d-5f4e-9a61-0d2b8e4c1a01
status: experimental
description: Detects DNS resolution of IPIDEA Packet, Castar and Hex SDK Tier One C2 and distribution domains reported by GTIG (TL-2026-4789). A hit means a host runs an app embedding a residential proxy SDK.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network
    - https://quointelligence.eu/2026/09/residential-proxies-hide-inside-everyday-apps-users-carry-the-risk/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-30
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1090
    - attack.t1665
logsource:
    category: dns_query
    product: windows
detection:
    selection_exact:
        QueryName:
            - 'packetsdk.io'
            - 'packetsdk.net'
            - 'packetsdk.xyz'
            - 'hexsdk.com'
            - 'castarsdk.com'
            - 'cfe47df26c8eaf0a7c136b50c703e173.com'
            - '8b21a945159f23b740c836eb50953818.com'
            - '31d58c226fc5a0aa976e13ca9ecebcc8.com'
            - '00857cca77b615c369f48ead5f8eb7f3.com'
    selection_sub:
        QueryName|endswith:
            - '.packetsdk.io'
            - '.packetsdk.net'
            - '.packetsdk.xyz'
            - '.hexsdk.com'
            - '.castarsdk.com'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or threat-intel sandboxes resolving the domains
    - DNS sinkhole or threat feed testing
level: high

Known false positives:

• Threat-intel sandboxes or researchers resolving the IOC domains
• DNS sinkhole / blocklist validation testing

Tuning notes: Exclude known analyst and sandbox hosts via a host lookup. Domains were taken down by Google in Jan 2026, so queries may return NXDOMAIN; alert on the query itself, not the response. Refresh the hash-named domain list from GTIG IOCs.

• 🔒 IPIDEA Proxy SDK Bundled Binary by SHA256 · unlock with TL Creds
• 🔒 Credential Stuffing Against One Account from Rotating Proxy IPs · unlock with TL Creds
• 🔒 Connection to IPIDEA Tier Two Proxy Node · unlock with TL Creds
• 🔒 Binary Signed by IPIDEA-Linked Hong Kong Code-Signing Certificates · unlock with TL Creds
• 🔒 Web Access to Residential Proxy SDK Distribution Sites · unlock with TL Creds
• 🔒 EarnSDK Tier One C2 DNS Query (BADBOX 2.0 Overlap) · unlock with TL Creds
• 🔒 Masquerading OneDriveSync / Windows Update Binary Execution · unlock with TL Creds
• 🔒 Password Spray from Single Source Across Many Accounts (Proxy Exit Node) · unlock with TL Creds

Indicators of compromise for IPIDEA residential proxy SDKs

As of 2026-10-30, Threadlinqs Intelligence tracks 29 indicators of compromise for TL-2026-4789.

Sample indicators (3 of 29)

• IP address: 49.51.68[.]143
• Domain: packetsdk[.]io
• File hash: aef34f14456358db91840c416e55acc7d10185ff2beb362ea24697d7cdad321f

Defanged, TLP:CLEAR. Full set of 29 indicators: unlock with TL Creds.

How IPIDEA residential proxy SDKs works

QuoIntelligence reports that residential proxy functionality is 'bolted onto an unrelated app through a monetization Software Development Kit (SDK)'. Developers embed the SDK for per-download or per-bandwidth revenue, the user is typically unaware the device relays third-party traffic, and the disclosure is often buried in terms of service rather than shown at installation. The report cites Ludo Club (Moonfrog, 100+ million installs) as an app tied to Bright Data as SDK provider, and states IPIDEA was embedded across 600+ Android applications and 3,000+ Windows binaries. Residential proxies reduce the effectiveness of controls built on IP reputation, geolocation and rate limiting, and are used for credential attacks, fraud, account takeover, scraping, unauthorized access and espionage.

Google Threat Intelligence Group (GTIG) published its disruption of IPIDEA on 2026-01-28. GTIG found IPIDEA operated at least 13 residential proxy / VPN brands (360 Proxy, 922 Proxy, ABC Proxy, Cherry Proxy, Door VPN, Galleon VPN, IP 2 World, Ipidea, Luna Proxy, PIA S5 Proxy, PY Proxy, Radish VPN, Tab Proxy) and controlled four SDKs: Castar, Earn, Hex and Packet (Android, Windows, iOS, WebOS). Hex SDK downloads redirect to castarsdk.com and the SDKs are identical. Operation uses a two-tier C2: Tier One domains receive device diagnostics and return a list of Tier Two nodes (about 7,400 servers at time of writing) used for proxy tasking and traffic routing. In one sample Tier One response the schedule, thread and heartbeat values and node connect/proxy ip:port pairs were returned. GTIG tied EarnSDK-related infrastructure to historical BADBOX 2.0 overlaps and noted Aisuru/Kimwolf as recently tracked related botnets.

GTIG also identified 3,075 unique Windows PE hashes with DNS requests to Tier One domains, including PacketShare-style monetized exit-node software and trojanized OneDriveSync and Windows Update masquerading binaries, not distributed directly by the IPIDEA actors. Code-signing certificates were issued to Hong Kong entities (HONGKONG LINGYUN MDT INFOTECH LIMITED, FIRENET LIMITED, MARS BROTHERS LIMITED, DATALABS LIMITED). The proxy did not only route traffic through the device but also sent traffic to the device, exposing other devices on the same local network. Observed abuse of exit nodes included access to victim SaaS environments, on-premises compromise and password spray attacks.

Disruption: Google took down C2 domains and marketing/SDK domains, Play Protect warns about and removes apps containing IPIDEA SDKs and blocks future installs, and Cloudflare, Spur and Lumen Black Lotus Labs assisted. Secondary reporting (The Hacker News) states about 5 million bots still connected after the action; this is not confirmed in the GTIG text and should be treated as unverified. Severity is analyst-assigned (not source-stated); no CVEs or CVSS apply.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1036.005 Masquerading: Match Legitimate Resource Name or Location

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy; T1665 Hide Infrastructure

Initial Access

T1078 Valid Accounts; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Credential Access

T1110.003 Brute Force: Password Spraying; T1110.004 Brute Force: Credential Stuffing

Execution

T1204.002 User Execution: Malicious File

Impact

T1496.002 Resource Hijacking: Bandwidth Hijacking

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1584.008 Compromise Infrastructure: Network Devices

Remediation for IPIDEA residential proxy SDKs

Immediate actions

• Block or alert on DNS/HTTP to the Tier One domains listed in the IOCs (packetsdk.*, hexsdk.com, castarsdk.com infrastructure and the hashed-name domains)
• Hunt endpoints and mobile device management inventories for apps containing Castar, Earn, Hex or Packet SDKs and for the listed file hashes
• Enable Google Play Protect on managed Android devices and remove flagged apps
• Review sign-ins from residential ISP addresses for password spray and impossible-travel patterns

Workarounds

• Avoid apps that offer payment for unused bandwidth
• Install apps only from official stores and verify Android TV devices against the certified partner list
• Segment IoT, smart-TV and guest devices from corporate networks

Longer-term hardening

• Move authentication controls from IP reputation and geolocation toward device, session and behavioral signals
• Require vetting of third-party monetization SDKs before an app is allowed on corporate devices
• Restrict installation of free VPN, proxy and bandwidth-sharing apps on corporate endpoints
• Apply phishing-resistant MFA to SaaS and remote-access accounts

Affected and fixed versions

• IPIDEA — Castar, Earn, Hex and Packet monetization SDKs (Android, Windows, iOS, WebOS)
  Vulnerable versions: 600+ Android apps and 3,075 Windows binaries observed with the SDKs
  Fixed in: Domains taken down and apps blocked by Google Play Protect (Jan 2026)
• IPIDEA — Galleon VPN, Radish VPN, Door VPN and related proxy clients
  Vulnerable versions: Trojanized/bundled clients
• Moonfrog — Ludo Club (cited by QuoIntelligence as a Bright Data SDK partner app)
  Vulnerable versions: Android and iOS versions tested September 2026

Timeline of IPIDEA residential proxy SDKs

• 2025-07-01 Google files a lawsuit against 25 Chinese entities over the locked-ioc-29 botnet (July 2025, exact day not stated in the source); GTIG later notes historical locked-ioc-29 overlaps in EarnSDK infrastructure.
• 2026-01-01 During a single seven-day period in January 2026 (exact dates not stated) GTIG observes 550+ threat groups from China, DPRK, Iran and Russia using IPIDEA exit nodes for SaaS access, on-premises compromise and password spray.
• 2026-01-28 GTIG publishes its disruption of IPIDEA: C2, marketing and SDK domains taken down, Play Protect begins removing apps with IPIDEA SDKs, with help from Cloudflare, Spur and Lumen Black Lotus Labs.
• 2026-01-29 The Hacker News, Help Net Security, The Register and others report the disruption; secondary reporting cites ~7,400 Tier Two servers, 13 brands and millions of devices removed.
• 2026-02-01 Sandra Cantero presents related residential proxy research at BSides Galway (February 2026, exact day not stated), as cited by QuoIntelligence.
• 2026-09-01 QuoIntelligence tests Ludo Club on Android and iOS (September 2026, exact day not stated) while examining proxy SDK integration in popular apps.
• 2026-09-09 QuoIntelligence publishes 'Residential Proxies Hide Inside Everyday Apps. Users Carry the Risk', covering SDK-based enrollment, lack of user consent and enterprise risk.

Sources cited for IPIDEA residential proxy SDKs

• INCIBE-CERT: Google leads the dismantling of one of the world's largest residential proxy networks incibe.es · Advisory · 2026-01-30
• Residential Proxies Hide Inside Everyday Apps. Users Carry the Risk quointelligence.eu · Research · 2026-09-09
• Google Cloud Blog: Disrupting the largest residential proxy network (GTIG) Google Cloud · Vendor report · 2026-01-28
• The Hacker News: Google disrupts IPIDEA, one of the world's largest residential proxy networks The Hacker News · News · 2026-01-29
• Help Net Security: Google disrupts proxy network used by 550+ threat groups Help Net Security · News · 2026-01-29
• The Register: Google starts dismantling residential proxy network criminals use to hide The Register · News · 2026-01-29
• Decipher: Google Disrupts IPIDEA Residential Proxy Network decipher.sc · News · 2026-01-29
• Proxyway: Google disrupts 10 IPIDEA-related Chinese proxy providers proxyway.com · News · 2026-01-29

More in threat intel

• Wuffy AI Toy Dog Scam Network: 250+ Fake Storefronts Laundering Proceeds Through Shell Companies (Huntress Declassified: Money Train, Episode Four)
• Europol/Eurojust Takedown of Crime-as-a-Service Investment Scam Infrastructure: 100+ Servers Seized, 7 Arrested
• CISA CI Fortify: Critical Infrastructure OT Isolation and Recovery Planning Guidance (2026)
• Microsoft Analysis of 383,000 Vulnerabilities: Takeover Flaws Dominate Exploited CVEs
• Shielder research: Hard-coded AES kernel key in U-Boot bootloader of Hi3519-based ARM device recovered via Unicorn Engine emulation