CTI · corroborated · 2026-08-21

Peer2Profit AstroProxy Residential Proxy Network Exposes Internal Network Resources

Full story & timeline

MITRE ATT&CK

• T1583 Acquire Infrastructure Resource Development
• T1584 Compromise Infrastructure Resource Development
• T1090 Proxy Command and Control

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Peer2Profit/AstroProxy Residential Proxy Network Connection
id: a7c3e1f4-8b2d-4a9c-b5e6-3f1d7c8a2b4e
status: experimental
description: >
    Detects network connections to known Peer2Profit or AstroProxy residential
    proxy infrastructure. Silent Push research (Aug 2026) confirmed PEER2PROFIT
    bandwidth-sharing applications supply residential proxy capacity to ASTROPROXY,
    which resells it. Employee devices running PEER2PROFIT become unauthorized
    proxy exit nodes exposing corporate IP space and internal resources.
references:
    - https://cyberpress.org/peer2profit-astroproxy-residential-proxy-network/
    - https://gbhackers.com/peer2profit-astroproxy-residential-proxy/
author: Tia N. List
date: 2026/08/21
tags:
    - attack.t1090
logsource:
    category: network_connection
    product: windows
detection:
    selection_domain:
        DestinationHostname|endswith:
            - 'peer2profit.com'
            - 'astroproxy.com'
            - 'astroproxy.net'
    selection_ip:
        DestinationIp:
            - '185.241.208.243'
    condition: selection_domain or selection_ip
falsepositives:
    - Legitimate use of Peer2Profit bandwidth-sharing application on personal devices
    - Research environments testing proxy detection
level: medium

References

• https://cyberpress.org/peer2profit-astroproxy-residential-proxy-network/
• https://gbhackers.com/peer2profit-astroproxy-residential-proxy/