CanOworms shows how rented proxy networks obscure attacker origin

At a glance

What this is: SecurityScorecard’s STRIKE team mapped CanOworms, a 633-server anonymization network used to hide attacker origin through rented proxy and VPN relays.

Why it matters: It matters because defenders who still rely on IP reputation, geolocation, and static blocklists will miss the infrastructure layer that now supports malware, fraud, and intrusion campaigns.

By the numbers:

• SecurityScorecard’s STRIKE Threat Intelligence Team mapped a 633-server anonymization network.
• The investigation confirmed 633 CanOworms servers observed during a 180-day window.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.

👉 Read SecurityScorecard’s analysis of the CanOworms anonymization network

Context

CanOworms is a rented proxy network that helps attackers hide where their traffic really comes from. The primary security gap is not malware detection alone, but the defender’s dependence on IP-based trust signals that are easy to rotate, reuse, or launder through shared infrastructure. In identity-rich environments, that same problem appears when access is tied to static secrets or service endpoints rather than verifiable workload and operator identity.

The article is about infrastructure abuse rather than a single malware family, which makes it relevant to IAM and NHI governance in a specific way. Proxy-for-hire services can be used to conceal credential spraying, command-and-control traffic, and the operational origin of attacks that touch cloud, email, or application layers. That makes attribution weaker and containment slower, especially where controls still assume stable source IPs.

Key questions

Q: How should security teams respond when attack traffic comes from proxy-for-hire networks?

A: Treat proxy traffic as an evasion layer, not proof of benign activity or a single campaign. Correlate handshake fingerprints, authentication behavior, destination sets, and asset criticality before blocking or escalating. If the same relay pattern appears across multiple events, investigate whether credential abuse, spraying, or command-and-control is being hidden behind disposable infrastructure.

Q: Why do proxy networks make intrusion attribution so difficult?

A: Because the visible IP usually belongs to the relay, not the actor. Shared infrastructure can host many customers, rotate quickly, and sit behind benign hosting providers, which means the same address may be reused for different threats. Attribution improves when defenders focus on certificate behavior, traffic timing, and associated identity activity rather than the source IP alone.

Q: What do defenders get wrong about IP blocklists in modern intrusion campaigns?

A: They treat a blocked address as a durable control when it is often only a temporary containment step. Attackers can move to another relay, rebuild certificates, or change hosting providers. Effective defence pairs temporary network blocking with stronger identity signals, especially on privileged access and authentication paths.

Q: Who is accountable when proxy infrastructure is used to conceal malicious access?

A: Accountability sits with the organisation operating the exposed service, the provider of the affected credentials or secrets, and the teams responsible for monitoring abnormal authentication. Frameworks such as MITRE ATT&CK and NIST SP 800-53 help map source concealment, credential abuse, and logging gaps to concrete defensive ownership.

Technical breakdown

How proxy-for-hire networks hide attacker origin

A proxy-for-hire service sits between the attacker and the target, relaying traffic so the destination sees the relay’s IP address instead of the operator’s. These networks are usually distributed across multiple hosts, hosting providers, and jurisdictions so takedowns are slow and replacement is easy. Their value is operational concealment, not sophistication. Because the same relay can serve many customers, threat intelligence often mislabels shared infrastructure as a single campaign node when it is really a commercial anonymity layer.

Practical implication: move beyond IP reputation alone and correlate TLS fingerprints, host behaviour, and destination patterns before blocking.

Why certificate fingerprints matter more than individual IPs

SecurityScorecard’s analysis shows how a self-signed certificate, JARM, and JA4X can identify a network even when servers are spread across unrelated addresses. That matters because IPs are mutable, but service configuration patterns often persist across redeployments. Fingerprints are not perfect identifiers, but they are more stable than a blocklist entry and can reveal whether a relay is part of a broader infrastructure pool rather than a single host.

Practical implication: build detection logic around certificate and handshake characteristics, then use IPs only as temporary enforcement points.

Credential spraying through shared relays and the identity angle

The observed SSH traffic suggests attackers are using the network to distribute authentication attempts across many targets while obscuring origin. That intersects directly with IAM and NHI governance because it changes how failed logins, API calls, and privileged access attempts should be interpreted. A flood of requests from diverse relays may hide a single operator, but it can also mask abuse of static credentials, tokens, or service accounts across cloud and edge systems.

Practical implication: treat anomalous authentication from proxy networks as a credential-abuse signal and tie it to secret rotation, session controls, and source verification.

Threat narrative

Attacker objective: The objective is to conceal operational origin while sustaining intrusion, credential abuse, fraud, or malware delivery through disposable infrastructure.

1. Entry begins when attackers route traffic through rented proxy or VPN relays so the target sees disposable infrastructure instead of the real source.
2. Escalation occurs when the same relay network is used to distribute credential spraying, command-and-control traffic, or other access attempts across many targets.
3. Impact follows when defenders block the visible relay while the operator simply shifts to another host, preserving attacker access and obscuring attribution.

NHI Mgmt Group analysis

Shared relay infrastructure is becoming an attribution layer, not just an evasion tactic. CanOworms shows how commodity and suspected state-linked actors can converge on the same rented transport layer without sharing ownership or tooling. That weakens the old assumption that one malicious IP or one blocked ASN meaningfully identifies an adversary. Practitioners should read these networks as infrastructure markets that sit above individual campaigns, not as isolated malicious hosts.

Static trust controls fail when the source is intentionally disposable. IP blocklists, geolocation, and provider reputation are useful only until the next relay swap. This is the same governance problem that identity teams face with static secrets and standing access: the control is tied to something that can be discarded faster than it can be reviewed. Disposable infrastructure pressure: defenders need control logic that survives relay churn, not just individual takedowns.

Credential abuse detection must account for anonymized origin. When SSH sprays, API calls, or login attempts arrive through proxy-for-hire services, source IP loses much of its evidentiary value. The better control question is whether authentication behavior matches expected workload or operator identity, especially for service accounts, tokens, and privileged remote-access paths. Teams that still anchor trust in network origin will keep overestimating containment.

This market confirms that cybercrime infrastructure is commercialising the same way identity abuse does. Shared relays, disposable certificates, and re-let hosting are all signs of a professionalised ecosystem built for repeat use across many tenants. That matters to security architecture because the defender is no longer confronting a single attacker asset, but a rentable layer that can support multiple threat models at once. The correct response is to govern the behaviors, not the apparent owner.

What this signals

Disposable infrastructure should be treated as an identity-adjacent governance problem, not only a network one. When attackers route activity through rented relays, the control gap shifts from IP filtering to behavioural assurance. That is why source verification, credential hygiene, and access-path observability matter even in campaigns that look like pure proxy abuse. For teams managing service accounts and workload access, the lesson is clear: trust must attach to identity and session behavior, not the apparent source address.

Identity teams should expect more abuse of shared infrastructure as attackers industrialise concealment. The commercial model behind proxy-for-hire services mirrors the broader move toward reusable, rentable attack tooling. In practice, that means authentication anomalies will increasingly arrive from noisy, distributed sources that are hard to classify by network alone. Teams can anchor their response in the identity layer by pairing log correlation with workload and privilege controls, and by reviewing the guidance in The 52 NHI Breaches Report alongside MITRE ATT&CK Enterprise Matrix.

For practitioners

• Correlate relay fingerprints with authentication telemetry Use JARM, JA4X, certificate traits, and destination patterns alongside login and SSH telemetry so a proxy network is detected as a reusable infrastructure pattern rather than isolated IP noise.
• Reduce reliance on source IP as a trust signal Treat IP reputation and geolocation as weak indicators for access decisions, especially where credential spraying or command-and-control may route through rented relays.
• Harden privileged and service-account authentication paths Prioritise MFA, short-lived credentials, and strict session controls on remote access, API endpoints, and service accounts that attackers can abuse through anonymizing infrastructure.

Key takeaways

• CanOworms shows that rented proxy networks now function as concealment infrastructure for both commodity and suspected state-linked actors.
• IP reputation alone is too weak to stop anonymized attack traffic, especially when relays rotate faster than blocklists can keep up.
• Identity-aware detection and short-lived credentials are the controls most likely to reduce the value of disposable infrastructure to attackers.

Key terms

• Proxy-for-hire network: A proxy-for-hire network is shared infrastructure that reroutes traffic for paying users so the real source is hidden behind a relay. In security terms, it turns infrastructure into an anonymity service that can support malware, credential abuse, and other malicious activity without owning the visible IP footprint.
• JARM: JARM is a TLS fingerprinting method that identifies servers by how they negotiate handshakes, rather than by their IP address alone. It helps defenders recognise the same service even when attackers move between hosts, certificates, or providers to evade blocking and attribution.
• JA4X: JA4X is a TLS and certificate-oriented fingerprint that helps characterise server behavior across changing infrastructure. It is useful when attackers reuse configuration patterns or certificate traits across many relays, allowing defenders to link apparently separate hosts into one operational cluster.
• Source concealment: Source concealment is the deliberate masking of the real origin of malicious traffic by using relays, proxies, or shared infrastructure. It reduces attribution quality and makes simple controls like IP blocklists less reliable, pushing defenders toward behavioral and identity-aware detection methods.

What's in the full report

SecurityScorecard’s full report covers the operational detail this post intentionally leaves for the source:

• The certificate, JARM, and JA4X fingerprints used to identify CanOworms members across changing IP space
• The host clustering and registration clues that helped separate relay nodes from unrelated infrastructure
• The June 2026 traffic patterns that suggest distributed credential spraying and proxy-based abuse
• The indicator set defenders can use to build detections around relay behaviour rather than static addresses

👉 SecurityScorecard’s full report covers the TLS fingerprinting, infrastructure mapping, and traffic patterns behind CanOworms.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity control to real-world attack paths and operational risk.