Synthient

The largest Botnet and VPN tracking platform. Protecting some of the largest Fortune 100 companies.

[Synthient @synthient]

https://t.co/J5caZJlIGp

[Synthient @synthient]

In our latest research, we reveal the inner workings of APSolo, one of the largest Chinese proxy botnets. The botnet continues to fuel DDoS attacks, fraud, and other cybercrime. Using multiple source-code and infrastructure pivots, we linked it to the Chinese proxy provider IPWeb.

Provider: IPWeb
Malware Family: Proxyware.APSolo
Size: 800K - 1.2 million daily active IPs

Full Story: https://t.co/A9Q0eDfT4f

[Synthient @synthient]

@usetraceix @vxunderground https://t.co/J5caZJlIGp

[Synthient @synthient]

@vxunderground When you accidentally open source your goop.

[Ben @deobfuscately]

Normally, I don’t make these types of posts, but for this, I wanted to make a small announcement about what's being built at Synthient.

Synthient Version 4 is finally here. A lot of late caffeine-fueled nights have finally culminated in one of the most ambitious updates we’ve rolled out in a long time. This update surpasses previous benchmarks in terms of data quality along with releasing Helios.

Release Notes:

Helios: We are launching a first-of-its-kind tool that exposes malicious traffic. Now, companies can identify fraud, intercept DDoS attacks, and catch post-compromise activity in real time. This enables organizations to attribute attacks and write intelligent detection rules.

Residential Proxy Coverage: Further improvements to our network and malicious infrastructure identification have resulted in a ~35% increase in the residential proxies and VPNs we see daily. Our platform now actively tracks over 35 million unique daily IPs.

Platform Improvements: This release brings a major overhaul to our dashboard, heavily improving the UX for researchers and developers. It is now faster and easier to pivot on entities, extract actionable insights, and build robust detections.

A huge thank you to all the individuals and organizations that have put their faith in Synthient. Excited for what we have planned for this year.

Full release notes here: https://t.co/40DfY3JVlx

[Synthient @synthient]

🐿️ Popa: From Sourcing to Distribution

https://t.co/JicPLU9TOg

[Synthient @synthient]

Beyond sharing IOCs we are also sharing a curated list of domains targeted from the month of may which can be found here.
https://t.co/7GktNeL6IT

[Synthient @synthient]

Who are the Victims of Residential Proxies? 🎯

Our latest research looks at the true targets of residential proxy networks. From infected streaming boxes to enterprise abuse, we document how unconsenting consumer devices are harvested to fuel widespread credential stuffing and internal network attacks.
https://t.co/k9LH04yxbZ

[Synthient @synthient]

New Research Piece: Socks5Systemz: Lives On
Socks5Systemz lives on as ProxyBox, infecting Windows devices via pirated software to build a 31K+ IP address proxy network targeting enterprise financial sectors.
https://t.co/QNtOqwhgf0

[Synthient @synthient]

Synthient Helps Disrupt World's Largest DDoS Botnet

The U.S. Department of Justice, in coordination with international law enforcement, has announced a major operation to disrupt the infrastructure of four of the world’s largest IoT botnets, including Aisuru and Kimwolf. Together, these botnets hijacked over three million devices worldwide to launch record-breaking Distributed Denial of Service (DDoS) attacks.

The Kimwolf botnet specifically targeted devices traditionally firewalled from the broader internet, enslaving them to act as proxy traffic for criminal networks and launch attacks reaching up to 30 Terabits per second.

Synthient is proud to have contributed to the DOJ's efforts. By identifying active exploitation, sharing malware samples, and coordinating disclosures with impacted parties, we helped neutralize this threat. We remain dedicated to making the web a safer place and are grateful to have played a role in this historic takedown.

Link: https://t.co/FUH7O82R5d

[Synthient @synthient]

@vxgiveaways

[Synthient @synthient]

@Xlab_qax 😆 They are not fans of the research we've been told.

[Synthient @synthient]

We are actively being DDoS'd given the publication of this research. We apologize if the website is offline.

[Synthient @synthient]

As part of our latest research we sent out 11 vulnerability disclosure notifications to the largest proxy providers. The scope involved millions of exposed devices, contributing to the growth of the worlds largest DDoS botnet.
https://t.co/FXYDYJEeB3

[Synthient @synthient]

https://t.co/amWPj0XJnP
A look into the internals behind a large-scale proxy operation, from the sourcing of IPs to the platform itself. How proxy providers utilize everything from TV boxes to free software for building out a pool of unique proxies.

[Synthient @synthient]

@UK_Daniel_Card Send us an email [email protected]

[Synthient @synthient]

@LaBuse56 @troyhunt @haveibeenpwned The blogpost from our end.
https://t.co/Df60qhT1zN

[Synthient @synthient]

Part 2 is live, making it the first billion+ corpus on the platform. 2.5x in size from Collection #1

[Troy Hunt @troyhunt]

This has been an extraordinary set of data to process: 1.3B unique passwords, 2B unique email addresses (including mine 😭) and almost 3M of our @haveibeenpwned subscribers in there. It’s been weeks of processing to get this loaded, and finally, it’s done https://t.co/f5okTCYstn

[Synthient @synthient]

@troyhunt @haveibeenpwned 🤝