# Residential Proxy SDKs Embedded in Everyday Apps Expose Users and Enterprises (IPIDEA, Bright Data partners)

> Monetization SDKs from residential proxy networks such as IPIDEA (Castar, Earn, Hex, Packet) are bundled into unrelated apps, games, VPN clients and TV software, silently turning user devices into proxy exit nodes. GTIG observed 550+ threat groups, including groups from China, DPRK, Iran and Russia, using IPIDEA exit nodes in a single week of January 2026 and disrupted the network on 2026-01-28; QuoIntelligence (2026-09-09) reports the broader risk to users and enterprises.

- **Published:** 2026-10-30T02:00:02Z
- **Last reviewed:** 2026-10-30T02:00:02Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4789
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-4789.png
- **ID:** TL-2026-4789
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** IPIDEA proxy network operators
- **Detections:** 9 (1 shown free below) · **IOCs:** 29 (3 shown free below)

## Description

QuoIntelligence reports that residential proxy functionality is 'bolted onto an unrelated app through a monetization Software Development Kit (SDK)'. Developers embed the SDK for per-download or per-bandwidth revenue, the user is typically unaware the device relays third-party traffic, and the disclosure is often buried in terms of service rather than shown at installation. The report cites Ludo Club (Moonfrog, 100+ million installs) as an app tied to Bright Data as SDK provider, and states IPIDEA was embedded across 600+ Android applications and 3,000+ Windows binaries. Residential proxies reduce the effectiveness of controls built on IP reputation, geolocation and rate limiting, and are used for credential attacks, fraud, account takeover, scraping, unauthorized access and espionage.

Google Threat Intelligence Group (GTIG) published its disruption of IPIDEA on 2026-01-28. GTIG found IPIDEA operated at least 13 residential proxy / VPN brands (360 Proxy, 922 Proxy, ABC Proxy, Cherry Proxy, Door VPN, Galleon VPN, IP 2 World, Ipidea, Luna Proxy, PIA S5 Proxy, PY Proxy, Radish VPN, Tab Proxy) and controlled four SDKs: Castar, Earn, Hex and Packet (Android, Windows, iOS, WebOS). Hex SDK downloads redirect to castarsdk.com and the SDKs are identical. Operation uses a two-tier C2: Tier One domains receive device diagnostics and return a list of Tier Two nodes (about 7,400 servers at time of writing) used for proxy tasking and traffic routing. In one sample Tier One response the schedule, thread and heartbeat values and node connect/proxy ip:port pairs were returned. GTIG tied EarnSDK-related infrastructure to historical BADBOX 2.0 overlaps and noted Aisuru/Kimwolf as recently tracked related botnets.

GTIG also identified 3,075 unique Windows PE hashes with DNS requests to Tier One domains, including PacketShare-style monetized exit-node software and trojanized OneDriveSync and Windows Update masquerading binaries, not distributed directly by the IPIDEA actors. Code-signing certificates were issued to Hong Kong entities (HONGKONG LINGYUN MDT INFOTECH LIMITED, FIRENET LIMITED, MARS BROTHERS LIMITED, DATALABS LIMITED). The proxy did not only route traffic through the device but also sent traffic to the device, exposing other devices on the same local network. Observed abuse of exit nodes included access to victim SaaS environments, on-premises compromise and password spray attacks.

Disruption: Google took down C2 domains and marketing/SDK domains, Play Protect warns about and removes apps containing IPIDEA SDKs and blocks future installs, and Cloudflare, Spur and Lumen Black Lotus Labs assisted. Secondary reporting (The Hacker News) states about 5 million bots still connected after the action; this is not confirmed in the GTIG text and should be treated as unverified. Severity is analyst-assigned (not source-stated); no CVEs or CVSS apply.

## MITRE ATT&CK

- T1195.002 Supply Chain Compromise: Compromise Software Supply Chain
- T1078 Valid Accounts
- T1204.002 User Execution: Malicious File
- T1036.005 Masquerading: Match Legitimate Resource Name or Location
- T1553.002 Subvert Trust Controls: Code Signing
- T1110.003 Brute Force: Password Spraying
- T1110.004 Brute Force: Credential Stuffing
- T1090 Proxy
- T1071.001 Application Layer Protocol: Web Protocols
- T1665 Hide Infrastructure
- T1583.001 Acquire Infrastructure: Domains
- T1584.008 Compromise Infrastructure: Network Devices
- T1496.002 Resource Hijacking: Bandwidth Hijacking

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**IPIDEA Residential Proxy SDK Tier One C2 DNS Check-in** (`TL-2026-4789-SPL-001`)

Endpoint DNS queries to Packet/Castar/Hex SDK Tier One domains (packetsdk.io/.net/.xyz incl. api-seed subdomains, hexsdk.com, dispatch1.hexsdk.com, castarsdk.com, hash-named .com domains). Tier One servers receive device diagnostics and return the Tier Two proxy node list, so a hit identifies a device enrolled as a residential proxy exit node (GTIG, TL-2026-4789).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1090, T1665
- **Data sources:** sysmon:EventCode22 (index=sysmon), Windows DNS server (DnsEvents), sysmon dns_query
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=22 earliest=-24h@h
| eval qn=lower(QueryName)
| where match(qn, "(^|\.)(packetsdk\.io|packetsdk\.net|packetsdk\.xyz|hexsdk\.com|castarsdk\.com)$") OR match(qn, "^(cfe47df26c8eaf0a7c136b50c703e173|8b21a945159f23b740c836eb50953818|31d58c226fc5a0aa976e13ca9ecebcc8|00857cca77b615c369f48ead5f8eb7f3)\.com$")
| stats count min(_time) as first_seen max(_time) as last_seen dc(QueryName) as distinct_domains values(QueryName) as queried_domains by host, Image, User
| eval first_seen=strftime(first_seen, "%F %T"), last_seen=strftime(last_seen, "%F %T")
| table host Image User queried_domains distinct_domains count first_seen last_seen
```

### Microsoft KQL

```kql
let tier1 = @"(^|\.)(packetsdk\.io|packetsdk\.net|packetsdk\.xyz|hexsdk\.com|castarsdk\.com)$|^(cfe47df26c8eaf0a7c136b50c703e173|8b21a945159f23b740c836eb50953818|31d58c226fc5a0aa976e13ca9ecebcc8|00857cca77b615c369f48ead5f8eb7f3)\.com$";
DnsEvents
| where TimeGenerated > ago(24h)
| where tolower(Name) matches regex tier1
| summarize Queries=count(), Domains=make_set(Name, 20), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ClientIP, Computer
| order by Queries desc
```

### Sigma

```yaml
title: Residential Proxy SDK Tier One C2 Domain DNS Query (IPIDEA Packet/Castar/Hex)
id: 7c1e2b54-3a0d-5f4e-9a61-0d2b8e4c1a01
status: experimental
description: Detects DNS resolution of IPIDEA Packet, Castar and Hex SDK Tier One C2 and distribution domains reported by GTIG (TL-2026-4789). A hit means a host runs an app embedding a residential proxy SDK.
references:
    - https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network
    - https://quointelligence.eu/2026/09/residential-proxies-hide-inside-everyday-apps-users-carry-the-risk/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-10-30
tags:
    - attack.command-and-control
    - attack.t1071.001
    - attack.t1090
    - attack.t1665
logsource:
    category: dns_query
    product: windows
detection:
    selection_exact:
        QueryName:
            - 'packetsdk.io'
            - 'packetsdk.net'
            - 'packetsdk.xyz'
            - 'hexsdk.com'
            - 'castarsdk.com'
            - 'cfe47df26c8eaf0a7c136b50c703e173.com'
            - '8b21a945159f23b740c836eb50953818.com'
            - '31d58c226fc5a0aa976e13ca9ecebcc8.com'
            - '00857cca77b615c369f48ead5f8eb7f3.com'
    selection_sub:
        QueryName|endswith:
            - '.packetsdk.io'
            - '.packetsdk.net'
            - '.packetsdk.xyz'
            - '.hexsdk.com'
            - '.castarsdk.com'
    condition: 1 of selection_*
falsepositives:
    - Security researchers or threat-intel sandboxes resolving the domains
    - DNS sinkhole or threat feed testing
level: high

```

**Known false positives:**

- Threat-intel sandboxes or researchers resolving the IOC domains
- DNS sinkhole / blocklist validation testing

**Tuning notes:** Exclude known analyst and sandbox hosts via a host lookup. Domains were taken down by Google in Jan 2026, so queries may return NXDOMAIN; alert on the query itself, not the response. Refresh the hash-named domain list from GTIG IOCs.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- IPIDEA Proxy SDK Bundled Binary by SHA256 (locked: unlock with TL Creds)
- Credential Stuffing Against One Account from Rotating Proxy IPs (locked: unlock with TL Creds)
- Connection to IPIDEA Tier Two Proxy Node (locked: unlock with TL Creds)
- Binary Signed by IPIDEA-Linked Hong Kong Code-Signing Certificates (locked: unlock with TL Creds)
- Web Access to Residential Proxy SDK Distribution Sites (locked: unlock with TL Creds)
- EarnSDK Tier One C2 DNS Query (BADBOX 2.0 Overlap) (locked: unlock with TL Creds)
- Masquerading OneDriveSync / Windows Update Binary Execution (locked: unlock with TL Creds)
- Password Spray from Single Source Across Many Accounts (Proxy Exit Node) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 29)

Defanged, TLP:CLEAR.

- IP address: `49.51.68[.]143`
- Domain: `packetsdk[.]io`
- File hash: `aef34f14456358db91840c416e55acc7d10185ff2beb362ea24697d7cdad321f`

Full set of 29 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Residential Proxies Hide Inside Everyday Apps. Users Carry the Risk](https://quointelligence.eu/2026/09/residential-proxies-hide-inside-everyday-apps-users-carry-the-risk/)
- [Google Cloud Blog: Disrupting the largest residential proxy network (GTIG)](https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network)
- [The Hacker News: Google disrupts IPIDEA, one of the world's largest residential proxy networks](https://thehackernews.com/2026/01/google-disrupts-ipidea-one-of-worlds.html)
- [Help Net Security: Google disrupts proxy network used by 550+ threat groups](https://www.helpnetsecurity.com/2026/01/29/ipidea-proxy-network-disrupted/)
- [The Register: Google starts dismantling residential proxy network criminals use to hide](https://www.theregister.com/2026/01/29/google_ipidea_crime_network/)
- [Decipher: Google Disrupts IPIDEA Residential Proxy Network](https://decipher.sc/2026/01/29/google-disrupts-ipidea-residential-proxy-network)
- [Proxyway: Google disrupts 10 IPIDEA-related Chinese proxy providers](https://proxyway.com/news/google-disrupts-10-ipidea-related-chinese-proxy-providers)
- [INCIBE-CERT: Google leads the dismantling of one of the world's largest residential proxy networks](https://www.incibe.es/index.php/en/incibe-cert/publications/cybersecurity-highlights/google-leads-dismantling-one-worlds-largest-residential-proxy-networks)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4789