Attackers are increasingly renting the infrastructure that hides them rather than exposing their own infrastructure. SecurityScorecard’s STRIKE Threat Intelligence Team, alongside partners FalconFeeds and Malanta, revealed one such operation: a 633-server proxy fleet dubbed CanOworms, leased out to commodity malware crews and possible state-linked actors. Rented proxies allow attackers to hide the true origin of malware, fraud, and intrusion attempts behind disposable IP addresses that get replaced faster than defenders can place them on a blocklist.
In this webinar, Richard Hummel, SecurityScorecard’s VP of Threat Intelligence and Research, and Gilad Friedenreich Maizles, SecurityScorecard’s Manager of Security and Threat Intelligence, discuss the research regarding how they unmasked the CanOworms network, why blocklists, geography, and reputation scoring fail against it, and which behavioral signals still work after an attacker rotates every address.
Watch the full webinar here.
A Network Built for Rent
CanOworms is rented infrastructure for malware operators who prefer leasing servers to building their own. Maizles described CanOworms as “a mesh network of servers that are designed to be used as the front for operations, usually for malware management operations.”
Each server in the mesh runs Squid Cache proxy software, a virtual private network (VPN) service, and Socket Secure version 5 (SOCKS5) proxy protocol at the same time. An attacker configures a payload to call one node, and that node relays traffic back to the real command-and-control (C2) server. Once an endpoint detection and response (EDR) tool flags one of those IP addresses, the attacker can swap it with one configuration change instead of a full rebuild.
| “If the IP itself gets caught in someone’s EDR, just change the IP. All it takes.” – Gilad Maizles, Manager, Security and Threat Intelligence |
One Open-Source Tip Led to 633 Servers
The researchers began investigating the malicious network when a researcher at FalconFeeds published indicators tied to a suspected Chinese state-sponsored actor. Maizles fed those indicators into SecurityScorecard’s Driftnet engine. Then he asked a simple question: was this one instance, or something bigger? He found a self-signed Transport Layer Security (TLS) certificate, labeled “kickass.” The certificate sat on the same servers as the Squid Cache proxy and the SOCKS5 service.
The certificate thread surfaced 633 servers worldwide, all running the exact same combination of services. Some servers dropped out of the mesh over time, and others joined it. The shared pattern, the same mix of proxy, VPN, and SOCKS5 services remained constant throughout. SecurityScorecard discovered that CanOworms was not a one-off cluster but a persistent, rentable network whose structure outlasted every address change, a pattern that underscores why defenders need to track behavior instead of reputation.
Infrastructure for Hire Is Changing Who Owns the Risk
Maizles said research points to a broader shift in how threat groups operate. Researchers believe that state-sponsored actors once built and ran every stage of an operation themselves, start to finish. Now specialized providers sell access to infrastructure, credentials, or stolen data, and take a cut of whatever the buyer earns.
Maizles explained, “Instead of the actor needing to generate their own infrastructure with each operation, they can now basically log into this massive network that enables them to do so much of what they used to do themselves.”
Hummel connected this shift to why law enforcement takedowns rarely stick. Agencies typically disrupt one layer, such as a hosting provider or a content delivery network. They rarely arrest the malware’s authors or the operators using it. He explained that “inevitably, threat groups just buy different malware, consult a different third party for infrastructure, and they’re up and running again a couple weeks later. We’ve seen that several times, but for the vast majority of takedowns, they just don’t have a lasting impact because of this whole criminal ecosystem.”
Hummel added that with underground LLMs, if your infrastructure is taken down, threat actors simply ask the model to spin up a new one, and it automatically rebuilds everything for them in just minutes.
Why Static Blocklists Cannot Keep Up
Traditional IP and domain blocklists fail against infrastructure like CanOworms, which bad actors built to be interchangeable. Hummel noted that a single IP address can host 10,000 domains, and service providers typically lease an IP address for a window ranging from three hours to seven days. Because a single IP can host thousands of domains and is leased for only hours or days, defenders who chase individual IPs and domains are always a step behind an adversary who can swap them out faster than any blocklist can be updated.
To address this new behavior, Hummel recommends tracking behavior instead of reputation. Watch for Transmission Control Protocol (TCP) flag anomalies and inconsistent hop counts. Defenders can also track TLS certificate hashes and JARM fingerprints (a method for identifying TLS server configurations). Like TCP behavior, these stay consistent across servers that share the same setup, even when the IP addresses change. These patterns persist even after an attacker rotates every IP address it uses.
Maizles explained that defenders need a trusted vendor to curate those detection rules and retire them automatically. Manually tracking every certificate hash and cipher suite does not scale for a typical security operations center (SOC) team. Hummel added, “Being able to try to block threats at that scale…becomes very difficult because a single IP address might be hosting 10,000 domains, and a single domain can churn extremely fast. So even if you were to put a bunch of domains or URLs on a block list, the next hour they could be invalidated.”
What Defenders Should Do Now
Hummel and Maizles suggest the following priorities for security teams to address proxy networks like CanOworms:
- Track behavioral signatures, including TLS cipher suites, JARM hashes, and certificate metadata, instead of relying on IP or domain reputation alone.
- Work with a threat intelligence provider that curates and retires detection rules automatically.
- Identify your organization’s most critical assets so you know what an attacker is actually after.
- Treat vendors, routers, and Internet of Things (IoT) devices as potential entry points.
- Assume supply chain exposure: an attacker targeting you may often be after someone you work with.
- After each public threat report, look beyond the listed indicators. Check whether related infrastructure, vendors, or assets in your environment could be part of the same campaign.
Read SecurityScorecard’s full CanOworms report for more details, and see how the STRIKE Threat Intelligence Team’s research connects threat intelligence to third-party risk management.
