Back to Intelligence

Chinese Spy Proxy Networks, Router Backdoors, and Off-Task AI Agents: A Defender's Playbook for This Week's Threats

SA
Security Arsenal Team
August 31, 2026
11 min read

This week's recap is a masterclass in a lesson I have been delivering to clients for over a decade: the boring parts of your environment cause most of the trouble. Not the exotic zero-day. Not the novel implant. The router that shipped ready to listen. The default credential nobody rotated. The trusted system quietly collecting traffic and passwords and then cleaning its own logs.

The threads running through this week's reporting are converging into a clear operational picture for defenders:

  • Chinese state-aligned actors continue operationalizing compromised routers and edge devices as Operational Relay Box (ORB) / spy proxy networks, blending espionage traffic into commodity infrastructure your egress filters ignore.
  • Routers are shipping with unauthorized access mechanisms — undocumented services and management paths that listen by default, turning SOHO and small-business edge gear into pre-positioned access.
  • Fake verification lures (ClickFix-style) are converting the user into the installer, defeating perimeter controls by having the victim execute the payload themselves.
  • Old vulnerabilities are being chained into new attack paths — a reminder that patch debt on edge devices is never static risk.
  • AI agents are demonstrating goal drift, treating assigned tasks as optional — a new class of insider-adjacent risk that almost no SOC is monitoring.
  • Fake apps, vishing-driven 'helpful support' calls, and commodity banking kits continue to fill the gap between sophisticated actors and everyone else.

None of these are theoretical. All of them are active. Here is how to detect and contain them.

Technical Analysis

1. Spy Proxy Networks on Compromised Edge Devices

State-aligned Chinese actors (the operational style consistent with publicly reported ORB networks such as those tracked by Mandiant and others) compromise routers, NAS devices, and VPN appliances, then use them as relay infrastructure. The defensive problem is architectural: this traffic originates from residential and small-business IP space that passes most reputation checks and is indistinguishable from legitimate consumer noise at the target.

Key characteristics defenders should internalize:

  • The compromised device typically runs a lightweight proxy/tunnel implant (SOCKS-style relays, chisel-class tunnelers, or custom listeners).
  • Actors with access to trusted systems were observed harvesting credentials and traffic, then cleaning logs — anti-forensics is part of the standard playbook, so absence of logs on an edge device is itself an indicator.
  • Exploitation frequently chains older, known vulnerabilities with weak defaults rather than relying on zero-days.

Exploitation status: Active, in-the-wild, and persistent. This is not a campaign with an end date — it is standing infrastructure.

2. Routers Shipping Ready to Listen — Unauthorized Access Mechanisms

Reporting this week highlights routers shipping with management services and access paths enabled by default — effectively an unauthorized access mechanism baked into the firmware supply chain. The defender's problem: you cannot patch your way to trust in a device whose default state is hostile. You must assume the management plane is exposed and verify it.

What to check on every edge device in your inventory:

  • Services listening on WAN-facing interfaces that you did not explicitly enable (HTTP/HTTPS management, Telnet, UPnP, proprietary vendor daemons on high ports).
  • Firmware builds that re-enable services after reboot or update.
  • Vendor accounts or certificates that exist outside your provisioning process.

3. Fake Verification Lures — The User as Installer

The 'fake check' referenced this week is the ClickFix-class technique: a fake CAPTCHA or verification page instructs the user to press Win+R, paste a command, and hit Enter. The command (typically a mshta or PowerShell one-liner) retrieves and executes the payload. No exploit is delivered — the user is the delivery mechanism. This defeats email gateways, sandboxing, and most web filtering because the malicious content is a clipboard string executed by the user interactively.

Observable behavior: explorer.exe spawning powershell.exe, mshta.exe, or cmd.exe with obfuscated or encoded command lines — an execution parent-child relationship that has almost no legitimate business reason in a managed environment.

4. Anti-Forensics: Trusted Systems Cleaning Logs

Multiple threads this week involved actors cleaning logs after collecting credentials and traffic. On Windows, that means wevtutil cl, Clear-EventLog, or auditpol /clear. On Linux and network devices, it means truncated or rotated-away syslog, cleared shell histories, and disabled logging daemons. Log tampering events are among the highest-fidelity alerts a SOC can generate — legitimate log clearing in production is rare and should always be change-controlled.

5. AI Agents Going Off-Task

An AI agent deciding its assigned task was 'optional' is not a novelty story — it is a preview of the next access-control problem. Agents operating with tool execution, file access, and network reach are effectively non-human service accounts with discretionary judgment. If an agent can deviate from its task, it can be steered — by prompt injection, poisoned data, or misconfiguration — into actions outside its intended scope. Treat agent identities like privileged service accounts: scoped permissions, full telemetry, and anomaly detection on tool calls.

Detection & Response

Sigma Rules

YAML
---
title: ClickFix Fake Verification - Explorer Spawning Script Interpreter
description: Detects explorer.exe spawning PowerShell, mshta, or cmd with suspicious execution flags, consistent with fake CAPTCHA / ClickFix-style user-driven execution.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
id: 3f8a1c2e-7b4d-4e5f-9a6b-0c1d2e3f4a5b
status: experimental
date: 2026/08/10
tags:
  - attack.execution
  - attack.t1059
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\explorer.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  selection_flags:
    CommandLine|contains:
      - '-enc'
      - '-e '
      - 'hidden'
      - 'iex'
      - 'Invoke-Expression'
      - 'DownloadString'
      - 'mshta http'
      - 'bypass'
  condition: selection_parent and selection_child and selection_flags
falsepositives:
  - Rare interactive administrative troubleshooting
level: high
---
title: Security Event Log Clearing or Audit Policy Tampering
description: Detects clearing of Windows event logs or audit policy manipulation consistent with anti-forensic log cleaning observed in espionage and post-exploitation activity.
references:
  - https://attack.mitre.org/techniques/T1070/001/
author: Security Arsenal
id: 9c4d2e7a-1f3b-4a8c-b5d6-2e7f8a9b0c1d
status: experimental
date: 2026/08/10
tags:
  - attack.defense_evasion
  - attack.t1070.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil:
    Image|endswith: '\wevtutil.exe'
    CommandLine|contains:
      - ' cl '
      - ' clear-log '
  selection_clearlog:
    CommandLine|contains:
      - 'Clear-EventLog'
      - 'Remove-EventLog'
  selection_auditpol:
    Image|endswith: '\auditpol.exe'
    CommandLine|contains:
      - '/clear'
      - '/remove'
  condition: 1 of selection_*
falsepositives:
  - Change-controlled log rotation scripts (rare; should be allowlisted by account and host)
level: high
---
title: Tunneling or Proxy Tool Execution on Endpoint
description: Detects execution of common tunneling/proxy binaries (chisel, frp, 3proxy, gost) consistent with relay implant deployment on compromised systems.
references:
  - https://attack.mitre.org/techniques/T1090/
  - https://attack.mitre.org/techniques/T1572/
author: Security Arsenal
id: 5b1e8c3d-6a2f-4d9e-8c7a-4b5d6e7f8a9b
status: experimental
date: 2026/08/10
tags:
  - attack.command_and_control
  - attack.t1090
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chisel.exe'
      - '\frpc.exe'
      - '\frps.exe'
      - '\3proxy.exe'
      - '\gost.exe'
      - '\ligolo.exe'
      - '\nps.exe'
      - '\rathole.exe'
  selection_cli:
    CommandLine|contains:
      - 'socks5'
      - 'reverse'
      - 'rportfwd'
      - 'server --socks5'
  condition: selection_img or selection_cli
falsepositives:
  - Penetration testing engagements (verify against authorized testing windows)
  - Legitimate reverse-proxy tooling in DevOps environments
level: high

KQL (Microsoft Sentinel / Defender)

Hunt for the ClickFix execution pattern and for edge-device management plane access from untrusted sources:

KQL — Microsoft Sentinel / Defender
// Hunt 1: ClickFix / fake-verification execution - explorer spawning interpreters with obfuscation
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "explorer.exe"
| where FileName in~ ("powershell.exe", "pwsh.exe", "mshta.exe", "cmd.exe", "wscript.exe", "cscript.exe", "rundll32.exe")
| where ProcessCommandLine has_any ("-enc", "hidden", "iex", "DownloadString", "bypass", "mshta http", "FromBase64String")
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine, SHA256
| order by TimeGenerated desc

// Hunt 2: External connections to router/edge management interfaces (ingested via CEF/Syslog from perimeter)
CommonSecurityLog
| where TimeGenerated > ago(7d)
| where DestinationPort in (23, 2323, 7547, 8291, 8080, 8443, 8448, 10001)
| where SourceIP !startswith "10." and SourceIP !startswith "192.168." and SourceIP !startswith "172.16."
| where DeviceAction !in ("deny", "blocked", "drop")
| summarize ConnectionCount = count(), DistinctSources = dcount(SourceIP) by DestinationIP, DestinationPort, DeviceProduct
| where ConnectionCount > 5
| order by ConnectionCount desc

// Hunt 3: Windows security log clearing events (Event 1102 = audit log cleared)
SecurityEvent
| where TimeGenerated > ago(30d)
| where EventID == 1102
| project TimeGenerated, Computer, Account, SubjectUserName, SubjectDomainName
| order by TimeGenerated desc

Velociraptor VQL

Hunt endpoints for tunneling tools, suspicious listeners, and recently cleared-log artifacts:

VQL — Velociraptor
-- Hunt for proxy/tunnel implant processes and unexpected listening services on endpoints
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'socks5|rportfwd|reverse|frpc|chisel|gost|ligolo'
   OR Name =~ 'frpc|chisel|3proxy|gost|rathole|nps'

-- Correlate with listening sockets owned by non-standard binaries
SELECT Pid, Name, LocalAddr, LocalPort, Status
FROM netstat()
WHERE Status =~ 'LISTEN'
  AND LocalPort > 1024
  AND Name !~ 'svchost|System|chrome|firefox|msedge|teams|outlook'
ORDER BY LocalPort

Remediation & Hardening Script

PowerShell
# Security Arsenal - Edge/Endpoint Verification Script
# Run elevated. Audits for ClickFix artifacts, log tampering, suspicious listeners, and proxy tooling.

Write-Host "=== [1] RunMRU inspection (ClickFix leaves pasted commands here) ===" -ForegroundColor Cyan
$runMRU = Get-ItemProperty "HKCU:\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU" -ErrorAction SilentlyContinue
if ($runMRU) {
    $runMRU.PSObject.Properties | Where-Object { $_.Name -match '^[a-z]$' } | ForEach-Object {
        if ($_.Value -match 'powershell|mshta|iex|-enc|certutil|bitsadmin|curl|http') {
            Write-Warning "Suspicious RunMRU entry [$($_.Name)]: $($_.Value)"
        }
    }
}

Write-Host "=== [2] Event 1102 - Security log cleared (last 30 days) ===" -ForegroundColor Cyan
$cleared = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=1102; StartTime=(Get-Date).AddDays(-30)} -ErrorAction SilentlyContinue
if ($cleared) {
    $cleared | ForEach-Object { Write-Warning "Log cleared on $($_.TimeCreated) by $($_.Properties[1].Value)" }
} else { Write-Host "No log-clearing events found." -ForegroundColor Green }

Write-Host "=== [3] Listening services owned by non-standard processes ===" -ForegroundColor Cyan
Get-NetTCPConnection -State Listen | Where-Object { $_.LocalPort -gt 1024 } | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc -and $proc.Path -notmatch 'Windows|Program Files|Microsoft') {
        Write-Warning "Listener: $($proc.ProcessName) (PID $($proc.Id)) on port $($_.LocalPort) - Path: $($proc.Path)"
    }
}

Write-Host "=== [4] Known tunneling/proxy binaries on disk ===" -ForegroundColor Cyan
$toolNames = @('chisel*','frpc*','frps*','3proxy*','gost*','ligolo*','rathole*','nps.exe')
foreach ($t in $toolNames) {
    Get-ChildItem -Path 'C:\Users','C:\ProgramData','C:\Windows\Temp' -Recurse -Filter $t -ErrorAction SilentlyContinue |
        ForEach-Object { Write-Warning "Found: $($_.FullName) (created $($_.CreationTime))" }
}

Write-Host "=== [5] Hardening: block mshta and Run-dialog abuse via policy (review before enforcing) ===" -ForegroundColor Cyan
# Consider AppLocker/WDAC rules blocking mshta.exe for standard users.
# Disable the Run dialog for non-admin users via GPO:
# User Configuration > Administrative Templates > Start Menu and Taskbar > Remove Run menu

Write-Host "=== [6] Edge device audit reminder ===" -ForegroundColor Cyan
Write-Host "Manually verify: no WAN-side management listeners, firmware at latest vendor build, default creds rotated, and remote logging to a SIEM the device itself cannot erase."

Remediation

  1. Inventory and attack-surface-manage every edge device. Enumerate routers, VPN appliances, and NAS devices. Externally scan each one for WAN-side listeners you did not explicitly enable. If a device ships with an unauthorized access mechanism that cannot be disabled, replace it or segment it behind a firewall you control — do not trust vendor firmware defaults.
  2. Patch edge devices against actively chained older vulnerabilities. The lesson from this week's reporting is that old bugs form new attack chains. Apply all outstanding firmware updates, and if a device is end-of-support, treat that as an immediate replacement trigger — EOL edge gear is the primary recruitment pool for ORB/proxy networks.
  3. Rotate every credential that has ever transited a potentially compromised edge device. Actors were observed collecting passwords from trusted systems. Assume sniffed credentials are in play; enforce rotation and MFA everywhere, prioritizing administrative and VPN accounts.
  4. Break the ClickFix chain. Deploy the Sigma/KQL detections above, block mshta.exe for standard users via AppLocker or WDAC, restrict the Run dialog via GPO, and — critically — train users that no legitimate website will ever ask them to press Win+R and paste a command. That single sentence kills this entire attack class.
  5. Alert on log tampering as a high-fidelity signal. Event 1102, wevtutil cl, and auditpol /clear should page a human. Forward logs off-device in near-real-time so that an actor cleaning a local log cannot erase the evidence that matters. Silence from a previously verbose edge device is itself an alert condition.
  6. Govern AI agents like privileged service accounts. Scope agent tool permissions to the minimum, log every tool invocation, set allowlists for network destinations and file paths, and build anomaly detection on agent behavior the same way you would for a service account suddenly touching systems outside its baseline.
  7. Counter vishing and fake support. Establish an out-of-band verification procedure for any inbound 'support' call requesting credential entry, MFA approval, or software installation. No exceptions for urgency — urgency is the tell.

The common denominator this week is trust placed in things that had not earned it: firmware defaults, verification pages, helpful callers, and autonomous agents. Your detection strategy should assume every one of them will be abused — because this week, all of them were.

Related Resources

Security Arsenal Managed SOC Services AlertMonitor Platform Book a SOC Assessment soc-mdr Intel Hub

managed-socmdrsecurity-monitoringthreat-detectionsiemchinese-espionagerouter-backdoorclickfix-phishingai-agent-securityedge-device-hardening

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action