CanOworms shows how rented proxy networks obscure attacker origin

At a glance

What this is: NHI Mgmt Group's analysis, drawing on SecurityScorecard's research: SecurityScorecard's STRIKE team mapped CanOworms, a 633-server anonymization network that hides attacker origin behind rented relays and weakens IP-based defensive controls.

Why it matters: It matters because identity security and cyber teams can no longer rely on address reputation alone when malicious activity is intentionally transiting shared infrastructure that changes faster than blocklists can absorb it.

Context

A rented proxy network is infrastructure sold to multiple customers so their traffic appears to come from the relay rather than the actual operator. In this case, that model is being used to obscure intrusion origin, which makes traditional perimeter assumptions around source IP, geography, and hosting reputation far less reliable.

The identity angle is indirect but real: defenders are trying to distinguish legitimate relay behaviour from malicious use of shared infrastructure, while threat actors are abusing the trust that systems place in network origin. For IAM, PAM, and NHI teams, the lesson is that access and detection decisions cannot depend on IP identity alone when the origin itself is for hire.

Key questions

Q: What fails when attackers route traffic through rented proxy networks?

A: IP reputation, geolocation, and simple blocklists lose much of their value because they describe the relay, not the actor. Security teams need to treat those signals as supporting evidence and rely instead on fingerprints, traffic patterns, and campaign correlation to distinguish a disposable relay from a genuine source of malicious activity.

Q: Why do rented relays make attribution harder for defenders?

A: Because many tenants can share the same exit infrastructure, the public address no longer identifies a single operator. Attribution becomes an evidence problem, not an address problem, and analysts have to distinguish the service providing the relay from the person using it.

Q: How can security teams detect proxy-for-hire infrastructure more reliably?

A: They should correlate stable technical traits such as TLS certificates, JARM, JA4X, and repeat traffic behaviour across time. A single indicator may be noisy, but a consistent cluster of network fingerprints is much harder for attackers to hide than an IP address that changes often.

Q: What should incident responders do when a malicious IP may be a rented proxy?

A: They should avoid treating the address as the end of the investigation. The better response is to preserve the fingerprint set, map related nodes, and look for shared behaviours that reveal the relay service behind the activity before making containment or attribution decisions.

Technical breakdown

How rented proxy infrastructure obscures attack origin

A proxy-for-hire network routes customer traffic through shared relay servers, so the public source IP belongs to the infrastructure provider rather than the attacker. That breaks common attribution shortcuts because blocklists, geolocation, and hosting reputation only describe the relay, not the operator behind it. In CanOworms, the same relay pool is shared across unrelated malware crews and suspected state-linked actors, which means the network behaves like a commercial anonymity service rather than a single botnet. The architectural point is simple: if many tenants can rent the same exit path, defenders cannot infer actor identity from the last hop.

Practical implication: Treat source IP as a weak signal and shift detection to server fingerprints, traffic patterns, and multi-signal correlation.

Why TLS fingerprints outlast disposable addresses

SecurityScorecard used a self-signed certificate, JARM, and JA4X to identify nodes that shared behavioural and cryptographic traits even when IPs changed. TLS fingerprints do not name an attacker, but they do describe how a server negotiates connections, presents certificates, and behaves on the wire. That makes them more durable than address-based indicators in a rental network where nodes rotate, certificates can be swapped, and relays can be rebuilt. The method also reduces false positives because a single certificate artifact was not enough on its own; corroboration from multiple fingerprints narrowed the fleet to 633 servers.

Practical implication: Build detection content around stable network fingerprints and corroborate them before blocking or escalating.

What shared relays mean for intrusion detection and attribution

Shared relay infrastructure compresses the value of routine control-plane assumptions. If one server can front traffic for many actors, then a command-and-control indicator may really be a disposable relay, and takedown pressure on the IP alone will have limited effect. That forces analysts to separate infrastructure ownership from infrastructure use. The broader governance issue is that defenders need evidence standards for attribution and response that reflect rented anonymity services, not just malware hosting. In practice, the right question is no longer only who owns the IP, but what service the IP is providing to the attacker.

Practical implication: Revise playbooks so triage, attribution, and blocking decisions account for proxy services masquerading as attacker infrastructure.

Threat narrative

Attacker objective: To hide malicious origin long enough to conduct malware activity, credential spraying, or intrusion operations without exposing attacker-owned infrastructure.

1. Entry begins when a customer rents access to shared proxy infrastructure and routes malicious traffic through a disposable relay instead of direct attacker-owned hosting.
2. Credential or malware activity is then concealed by the relay, which makes the public source IP look like ordinary proxy traffic rather than the true origin of the intrusion.
3. Impact occurs when defenders cannot reliably block, geolocate, or reputation-score the attacker because the infrastructure rotates faster than traditional controls can track it.

Breaches seen in the wild

• Shai Hulud npm malware campaign: Shai Hulud campaign: npm malware exposed secrets on GitHub.
• CircleCI breach 2023: Malware stole a CircleCI engineer's SSO session; attackers exfiltrated customers' CI/CD secrets and keys, forcing a platform-wide rotation.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Rented proxy infrastructure creates an attribution gap, not just an evasion trick. The practical problem is that defenders often still treat public IPs as if they were stable identities. In a shared relay market, the address belongs to the service layer, while the attacker identity lives behind it. Practitioner takeaway: attribution and response need evidence from fingerprints, telemetry, and campaign behaviour, not source address alone.

CanOworms is a named example of infrastructure-as-a-service for concealment. The article shows a market where anonymity services are being re-used by commodity malware crews and suspected state-linked actors alike. That convergence matters because it makes relay infrastructure durable, priced, and replaceable in ways that frustrate simple takedown logic. Practitioner takeaway: assume malicious infrastructure can be rented as easily as it can be built.

The control gap is origin trust, not just blocklist coverage. Security teams still over-weight blocklists and hosting reputation even when the attacker can rotate relays faster than the control can mature. This is the same governance failure seen across modern abuse ecosystems: detection depends on a static origin assumption that the threat model no longer supports. Practitioner takeaway: promote fingerprint-led detection and campaign correlation into the core monitoring model.

Identity teams should care because network provenance is becoming part of trust policy. When malicious traffic can borrow the identity of a relay server, the decision boundary shifts from simple authentication to provenance-aware trust. That does not make this an IAM-only issue, but it does mean identity programmes must coordinate with detection engineering and threat intelligence on how origin evidence is evaluated. Practitioner takeaway: fold source-provenance assumptions into security governance reviews.

Disposal speed is the new concealment concept. The network works because relays are easy to replace, which means the useful security signal is the pattern of reuse, certificates, and connection behaviour rather than any one IP address. This is the right mental model for analysts evaluating commercial anonymity services: persistence lives in the service design, not the address. Practitioner takeaway: hunt for stable behavioural traits, not just static indicators.

What this signals

Shared anonymity infrastructure is now part of the threat economy. The article shows that concealment services are no longer a fringe tool, but a reusable layer that both criminal and suspected state-linked actors can rent. For defenders, that means network origin has to be treated as a weak trust signal inside broader detection and response workflows.

Rented proxies expose a governance problem in how organisations use external trust signals. Many monitoring stacks still elevate IP reputation, hosting country, and provider reputation even when those signals are easy to inherit or rotate. The right response is to harden origin validation in detection content and make fingerprint-led hunting a standard part of SOC practice.

For practitioners

• Prioritise fingerprint-based detection Use TLS certificate traits, JARM, and JA4X together so a relay can still be recognized after its IP changes.
• De-emphasise source IP in triage Treat blocklists and geolocation as supporting evidence only when the same relay pattern appears across multiple observations.
• Separate relay ownership from relay use Document whether an observed host is a likely proxy service, a disposable relay, or a true attacker-controlled node before you escalate attribution.
• Update playbooks for shared infrastructure abuse Make sure incident handling includes campaign correlation, alternative indicators, and escalation criteria for proxy-for-hire networks.

Key takeaways

• Rented proxy networks weaken the assumption that source IP reflects attacker identity, which makes traditional blocking and reputation controls far less reliable.
• SecurityScorecard’s mapping of 633 servers shows that concealment infrastructure is already operating at meaningful scale and can be reused across different threat groups.
• Defenders need fingerprint-based detection and campaign correlation because the service layer behind the relay matters more than any one disposable address.

Key terms

• Proxy-for-hire network: A proxy-for-hire network is shared infrastructure that reroutes traffic for paying users so the real source is hidden behind a relay. In security terms, it turns infrastructure into an anonymity service that can support malware, credential abuse, and other malicious activity without owning the visible IP footprint.
• TLS Fingerprinting: TLS fingerprinting is a way to identify a client from the handshake details it exposes when a secure connection starts. Those details can include cipher suites, extensions, supported groups, and message ordering. Security teams use it to classify browsers, flag bots, and add a non-invasive signal to fraud and abuse detection.
• Attribution gap: The attribution gap is the distance between what an AI agent did and what the enterprise can prove about who authorized it, what it was allowed to do, and who is accountable. It is an identity and governance problem that becomes visible during audits, incidents, and legal disputes.
• Disposable relay: A disposable relay is a server used temporarily as an exit point for traffic and replaced when it becomes noisy, blocked, or burned. It is operationally useful because defenders may see only the relay, not the underlying service or attacker controlling its use.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect identity control decisions to broader security operations and governance.