← Back to Feed
Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)
September 16, 2026 · AhnLab ASEC · Severity: HIGH
This article reports that the threat actor Larva-25012 has resumed distributing proxyware in the second half of 2026, targeting already infected systems. The campaign focuses on proxyjacking attacks that compromise devices for use as proxy nodes. 📌 **Analyst Note:** The strategy of re-infecting existing victims suggests a focus on maintaining access rather than expanding reach. Defenders should ensure thorough cleanup and monitoring after initial compromises to prevent proxyware installation.
Key Takeaways
- The threat actor Larva-25012 has resumed actively distributing proxyware in the second half of 2026, focusing on systems that are already compromised rather than using new infection methods.
- Proxyjacking attacks continue to be a concern as they turn infected devices into proxy nodes, often without the user's knowledge, for malicious activities like anonymizing traffic.
- Rather than developing novel distribution techniques, the actor appears to be leveraging existing footholds to deploy proxyware, indicating a shift toward re-infecting previously compromised systems.