Cybercriminals Go Stealth: Residential Proxies Mask Malicious Activity, Hiding in Plain Sight

An increasing number of cybercriminals are shifting toward the use of so-called residential proxy networks, transforming ordinary internet traffic into an effective cloak for their operations. This tactic renders malicious activity nearly indistinguishable from that of legitimate users, thereby significantly complicating threat detection efforts.

In the past, cybercriminals gravitated toward bulletproof hosting—providers that offer servers with no questions asked, routinely ignoring abuse reports and refusing to disclose client data. However, in the wake of mounting international investigations and a wave of arrests tied to these services, many threat actors have begun seeking new methods of concealment.

As revealed at the Sleuthcon conference, there is a marked pivot away from traditional hosting in favor of specialized VPN services and proxy networks. These tools enable constant IP rotation and aggregate the traffic of multiple users into a single stream. Industry experts noted that the fundamental challenge lies in the inability to differentiate “malicious” traffic from “benign” within such networks—the architecture itself renders users indistinguishable.

Residential proxies, in particular, play a pivotal role in this strategy. These decentralized nodes operate on everyday devices—obsolete smartphones, laptops, smart home gadgets—providing “real” IP addresses associated with homes or offices, which are inherently trusted by security systems. This type of traffic is far more difficult to block or trace. Cybercriminals increasingly exploit these networks, especially when they can blend into the same IP ranges as employees of targeted organizations, making their activities invisible to conventional filters and monitoring systems.

Proxy technology is hardly a novelty in the criminal underground. As early as 2016, the U.S. Department of Justice cited the proxy-based “fast-flux” hosting infrastructure of the Avalanche cybercrime platform as a major investigative obstacle. But the fact that such services are now widely marketed as quasi-legitimate offerings signals a significant evolution in the cybercrime ecosystem.

Today’s proxy networks demand no technical expertise from their users—everything is packaged and sold as a service. These platforms often operate blindly: they log nothing, track no users, and channel traffic from hundreds of devices, further hampering the efforts of law enforcement agencies.

As for combating this trend, the outlook remains bleak. Authorities may attempt to dismantle known proxy providers, as they once did with rogue hosting services, but the technology has become too deeply embedded in the fabric of the modern internet. Shutting down a single malicious operator does little to resolve the broader issue—the infrastructure persists and will continue to be exploited, for both legitimate and nefarious purposes.

While proxies remain a vital instrument of digital freedom, they have also become a trusted veil for cyberthreats—masking attacks, espionage, and malware distribution behind streams of household IP addresses.