FIRST.orgNew on the FIRST blog: Jonathan Andersen, CEO and Co-Founder of Webscout and #FIRSTCTI26 speaker, on why residential proxy networks have become one of the internet's most consequential threat enablers, and why no single organization can see the full picture.
When Kimwolf emerged in late 2025, it infected 2 million+ devices, mostly off-brand Android TV boxes sold openly on retail platforms with proxy SDKs already installed at the factory.
The supply chain had done the work for the operators.
The structural problem isn't the botnet. It's the residential proxy layer itself, embedded across critical networks before most defenders were looking for it.
๐ Residential proxies route traffic through real ISP-assigned IPs. Reputation and geolocation defenses largely fail.
๐ฆ SDK-based provisioning embeds proxy code in free apps. Users consent in EULA fine print. ๐ญ Hardware supply chain compromise pre-loads devices before they ever reach a buyer.
โกActive exploitation, like Kimwolf, turns proxy endpoints into footholds inside local networks.
What the data shows:
๐ Infoblox: nearly 1 in 4 enterprise customers had at least one device querying Kimwolf-related domains.
๐๏ธ Spur: proxy endpoints inside ~300 government networks, 318 utilities, 166 healthcare orgs, and 141 banks.
๐ Google GTIG: 550+ distinct threat groups using IPIDEA exit nodes in a single 7-day period in January 2026, including actors linked to China, North Korea, Iran, and Russia.
Jonathan highlights that countering these networks requires telemetry, forensics, and intelligence no single organization has alone. Webscout is building a vetted trust group for researchers and seeking ISP partners willing to host research nodes.
Inter-AS coordination challenges like these also sit squarely within the focus areas of FIRST's NETSEC SIG, which convenes network operators and researchers around exactly this kind of work.
๐ Read more: https://go.first.org/mfx3c
Joe Sลowik
13reak 
fellmoon ๐ด
Giaco
