Home › Threat Actors › Lurking Lizard
← All Threat Actors
Nation-State high China (assessed)

Lurking Lizard

China-based cybercrime group (Infoblox: infrastructure and WHOIS evidence point to a "likely" Chinese origin; no confidence level stated) · Financial — commercial residential proxy brokering

Reports 1
Active Since 2022
Last Reported 15 Jul 2026
Sectors Targeted finance, critical-infrastructure, communications, government, professional-services

Tactics, Techniques & Procedures (TTPs)

  • Trojanised software installers: modified 7-Zip, VPN apps, and system utilities silently enrol victim devices as proxy nodes on installation
  • Over 230 lookalike domains impersonating legitimate proxy service brands for malware distribution
  • Silent proxyware installation: victim devices route attacker-controlled traffic through their residential IP addresses without user awareness
  • Commercial proxy rental interface: customer-facing portal markets access to the compromised device network as a legitimate "enterprise proxy service"
  • Residential IP diversity: proxy nodes scattered across genuine consumer and business ISP addresses in target countries, defeating geofencing and datacenter-IP blocklists
  • Active infrastructure management: responds to competitor takedowns by expanding lookalike domain portfolio, capturing confused victims from disrupted services
  • Lookalike domains impersonating IPIDEA, SmartProxy, IP Royal and 911Proxy
  • Fake "independent" proxy-review sites that drive traffic to its own storefronts
  • Fake 7-Zip installer hosted on 7zip[.]com (the real site is 7-zip[.]org)

Known Targets

End-user devices worldwide enrolled as involuntary proxy nodes (Infoblox gives no victim counts, sectors or geographies)

Analyst Notes

Disclosed by Infoblox (blog dated 7 July 2026; actor found January 2026) and active since at least August 2022. Infoblox rates prevalence as "Uncommon". WireVPN is reported as its newest public-facing brand (secondary reports, medium-low confidence); brands are not aliases. Infoblox ties it to IPIDEA, whose infrastructure Google disrupted in January 2026. CORRECTED: earlier text claimed "moderate confidence based on code language" and state-adjacent customers; neither appears in the Infoblox page and both were removed. Infoblox lists no ATT&CK IDs; those below are the site's own mapping.

MITRE ATT&CK Techniques

T1608.001 Stage Capabilities: Upload Malware (trojanised installers) T1090.002 Proxy: External Proxy (residential proxy network) T1583 Acquire Infrastructure (lookalike domain network) T1204.002 User Execution: Malicious File (trojanised software execution)

Intelligence Reports

Analysis financecritical-infrastructure

Lurking Lizard: How a China-Linked Cybercrime Group Built a Global Residential Proxy Network Through Fake Software

Infoblox and The Hacker News disclosed in July 2026 that Lurking Lizard, a China-based financially motivated threat group, operates an industrial-scale residential proxy business sustained by trojaned installers for legitimate software. The network has processed hundreds of millions of proxy requests and is actively rented to criminal and espionage-linked operators.

15 Jul 2026 · 12 min read