Recent intelligence from AlienVault OTX highlights the active distribution of the "Popa" Android SDK, a proxyware tool designed to enroll consumer devices—specifically phones, tablets, and streaming boxes—into a commercial residential proxy network. Active since at least 2020, this campaign involves several malware families including Popa, Loopop, Neupop, Moneytiser, and Hopanet. The threat actors distribute these SDKs by bundling them inside seemingly legitimate consumer streaming, IPTV, and utility applications. Once installed, the malware silently relays third-party traffic through the victim's device immediately upon the host app's launch, often without user disclosure or consent, effectively turning user hardware into a commodity for resale to proxy services like NetNut.
Threat Actor / Malware Profile
- Malware Families: Popa (primary), Loopop, Neupop, Moneytiser, Hopanet.
- Adversary Motivation: Financial gain via the monetization of residential IP addresses.
- Distribution Method: Supply chain injection via third-party consumer applications, primarily IPTV players, streaming apps, and system utilities available outside official app stores.
- Payload Behavior: The SDK initializes immediately upon the execution of the host application. It establishes a connection to C2 infrastructure to receive instructions for proxying traffic. The device then acts as a node, forwarding HTTP/S traffic from paying customers of the proxy service.
- C2 Communication: Communicates with specific domains to register the device and receive proxy assignments. Traffic appears as standard HTTPS, blending in with normal user activity.
- Persistence: Achieved by embedding within the startup routines of the host application; the malware runs as long as the infected app is active or backgrounded.
IOC Analysis
The provided intelligence consists primarily of network-based indicators (domains and hostnames) associated with the proxyware's registration and command infrastructure.
- Indicator Types: Domains (e.g.,
nice-protect.com,rainproxy.io), Hostnames (e.g.,s01691.novel-layer.com). - Operational Guidance: SOC teams should immediately import these domains into DNS fireholes and web proxy blocklists. While the malware targets Android endpoints, the DNS requests traverse the corporate network if mobile devices are connected to Wi-Fi. Enterprises with Mobile Device Management (MDM) solutions should push these blocklists to managed mobile devices.
- Decoding Tooling: Passive DNS (pDNS) services can be used to identify historical resolution of these domains, revealing potential infections predating the current blocklist implementation.
Detection Engineering
YAML
---
title: Potential Popa Proxyware DNS Resolution
id: 1a2b3c4d-5e6f-4a5b-8c9d-0e1f2a3b4c5d
description: Detects DNS queries to domains associated with the Popa Android proxyware SDK and its variants (Moneytiser, Loopop, Neupop).
status: experimental
author: Security Arsenal
date: 2026/07/19
tags:
- attack.command_and_control
- attack.t1071.001
logsource:
category: dns
product: windows
detection:
selection:
query|contains:
- nice-protect.com
- house-spirit.com
- gmslb.net
- rainproxy.io
- enigmaproxy.net
- fast-mob.com
- pulse-vol.com
condition: selection
level: high
---
title: Popa Proxyware Network Connection Attempt
id: 2b3c4d5e-6f7a-5b6c-9d0e-1f2a3b4c5d6e
description: Detects outbound network connections to known Popa proxy infrastructure hostnames.
status: experimental
author: Security Arsenal
date: 2026/07/19
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationHostname|contains:
- nice-protect.com
- house-spirit.com
- gmslb.net
- rainproxy.io
- enigmaproxy.net
- fast-mob.com
- pulse-vol.com
- s01691.novel-layer.com
condition: selection
level: high
kql
// Hunt for Popa Proxyware IOC DNS resolution in Microsoft Sentinel
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteUrl has_any ("nice-protect.com", "house-spirit.com", "gmslb.net", "rainproxy.io", "enigmaproxy.net", "fast-mob.com", "pulse-vol.com", "novel-layer.com")
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP, ActionType
| summarize count() by DeviceName, RemoteUrl
| order by count_ desc
powershell
# IOC Hunt Script for DNS Cache and Hosts File
# Checks for resolution of Popa Proxyware domains on Windows endpoints
$IOC_List = @(
"nice-protect.com",
"house-spirit.com",
"gmslb.net",
"rainproxy.io",
"enigmaproxy.net",
"fast-mob.com",
"pulse-vol.com",
"novel-layer.com"
)
Write-Host "[*] Starting hunt for Popa Proxyware IOCs..." -ForegroundColor Cyan
# 1. Check DNS Cache
Write-Host "[*] Checking local DNS Client Cache..." -ForegroundColor Cyan
$DNSEntries = Get-DnsClientCache
$Found = $false
foreach ($IOC in $IOC_List) {
$Match = $DNSEntries | Where-Object { $_.Entry -like "*$IOC*" }
if ($Match) {
Write-Host "[!] ALERT: Found cached DNS entry for $IOC" -ForegroundColor Red
$Match | Select-Object Entry, Data, Type | Format-Table
$Found = $true
}
}
if (-not $Found) { Write-Host "[-] No IOCs found in DNS Cache." -ForegroundColor Green }
# 2. Check Hosts File
Write-Host "[*] Checking Hosts file..." -ForegroundColor Cyan
$HostsPath = "$env:SystemRoot\System32\drivers\etc\hosts"
if (Test-Path $HostsPath) {
$HostsContent = Get-Content $HostsPath
foreach ($IOC in $IOC_List) {
if ($HostsContent -match $IOC) {
Write-Host "[!] ALERT: Found $IOC in Hosts file." -ForegroundColor Red
Select-String -Path $HostsPath -Pattern $IOC
}
}
} else {
Write-Host "[-] Hosts file not accessible." -ForegroundColor Yellow
}
Response Priorities
- Immediate: Block all identified domains (
nice-protect.com,rainproxy.io, etc.) at the network perimeter (DNS Firewall, Web Proxy) and on mobile DNS resolvers. - 24h: If mobile device management is in use, audit corporate devices for the installation of unverified IPTV or streaming applications and check network logs for traffic to the listed IOCs.
- 1 Week: Review BYOD (Bring Your Own Device) policies to restrict the installation of unapproved third-party applications that may serve as vectors for proxyware SDKs.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
darkwebotx-pulsedarkweb-malwarepopaproxywareandroidresidential-proxyiot
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.