Home › Threat Actors › Lurking Lizard
← All Threat Actors
Cybercrime high China (assessed)

Lurking Lizard

China-based cybercrime group (Infoblox — moderate confidence based on code language patterns and infrastructure) · Financial — commercial residential proxy brokering / infrastructure-as-a-service for criminal and potentially state-adjacent operators

Reports 1
Active Since 2022
Last Reported 15 Jul 2026
Sectors Targeted finance, critical-infrastructure, communications, government, professional-services

Tactics, Techniques & Procedures (TTPs)

  • Trojanised software installers: modified 7-Zip, VPN apps, and system utilities silently enrol victim devices as proxy nodes on installation
  • Over 230 lookalike domains impersonating legitimate proxy service brands for malware distribution
  • Silent proxyware installation: victim devices route attacker-controlled traffic through their residential IP addresses without user awareness
  • Commercial proxy rental interface: customer-facing portal markets access to the compromised device network as a legitimate "enterprise proxy service"
  • Residential IP diversity: proxy nodes scattered across genuine consumer and business ISP addresses in target countries, defeating geofencing and datacenter-IP blocklists
  • Operator resale to criminal customers and assessed state-adjacent actors who require residential IP routing for operational security
  • Active infrastructure management: responds to competitor takedowns by expanding lookalike domain portfolio, capturing confused victims from disrupted services

Known Targets

End-user victims globally (devices enrolled as involuntary proxy nodes via trojanised installers)Downstream targets of customers renting Lurking Lizard proxy infrastructure (varies by customer — criminal to potentially state-adjacent)

Analyst Notes

Disclosed by Infoblox in July 2026. Lurking Lizard has operated since at least August 2022, maintaining continuous operations through multiple years despite industry awareness and competitor disruptions. The business model is architecturally distinctive: rather than using compromised infrastructure solely for direct attack operations, Lurking Lizard commercialises it — generating revenue while simultaneously making the infrastructure available to customers whose purposes may range from web scraping to cyber espionage. The dual-use nature of residential proxy networks makes attribution of downstream attacks through this infrastructure extremely difficult; traffic appears to originate from legitimate consumer devices. The group's response to competitor takedowns (expanding lookalike domain portfolio to capture confused users from disrupted services like 911Proxy) demonstrates active market intelligence and opportunistic customer acquisition. China-based assessment is moderate confidence, based on code language characteristics, infrastructure registration patterns, and customer base overlap with China-nexus threat actor infrastructure usage.

Also Known As

Lurking Lizard (Infoblox designation)

MITRE ATT&CK Techniques

T1608.001 Stage Capabilities: Upload Malware (trojanised installers) T1090.002 Proxy: External Proxy (residential proxy network) T1583 Acquire Infrastructure (lookalike domain network) T1204.002 User Execution: Malicious File (trojanised software execution) T1199 Trusted Relationship (infrastructure resale to threat actor customers)

Intelligence Reports

Analysis financecritical-infrastructure

Lurking Lizard: How a China-Linked Cybercrime Group Built a Global Residential Proxy Network Through Fake Software

Infoblox and The Hacker News disclosed in July 2026 that Lurking Lizard, a China-based financially motivated threat group, operates an industrial-scale residential proxy business sustained by trojaned installers for legitimate software. The network has processed hundreds of millions of proxy requests and is actively rented to criminal and espionage-linked operators.

15 Jul 2026 · 12 min read