Cybercriminals have ditched their old playbook. Instead of using sketchy hosting services that law enforcement can easily track, they now hide their attacks within normal internet traffic. This makes detecting malicious activity nearly impossible for traditional security systems.
Moving Beyond Old-School Hiding Tactics
Over the past three years, cybercriminals have completely changed the way they used to operate. They’ve abandoned “bulletproof” hosting services that authorities could easily spot and shut down. Instead, they now use purpose-built VPNs and proxy services that constantly rotate and mask IP addresses.
Cybersecurity Ventures predicts global cybercrime costs will hit more than $10 trillion annually by 2025, up from $3 trillion in 2015. Criminals have adapted to increased law enforcement pressure by using the legitimate traffic.
Residential Proxies Are the Perfect Disguise
Current cybercriminals rely on residential proxy services that route attacks through legitimate consumer devices. Such services have millions of real IP addresses with precise location data, helping criminals bypass security systems that protect businesses, governments, and online stores.
The FBI reports that criminals deploy malware on old routers to convert them into proxies they sell on networks such as 5Socks and Anyproxy. Recent law enforcement raids revealed these operations charge between $9.95 and $110 per month for access to thousands of residential proxies.
Online gaming platforms face particularly serious threats from these masked attacks, but they’re also fighting back with innovative solutions. Criminals flood gaming servers with fake traffic to shut them down, while poker sites become prime targets because they process high-value transactions in real-time.
However, popular poker tables have developed some of the industry’s most advanced behavioral analysis systems out of necessity. They use machine learning to track playing patterns, detect unusual betting behaviors, and identify coordinated attacks. Other industries now adopt these poker-developed technologies to fight all those proxy-based threats.
Why Detection Has Become Nearly Impossible
The biggest problem is that you can’t tell the difference between malicious and legitimate traffic when it flows through the same networks. Security teams face an impossible task – blocking bad actors without affecting legitimate users.
The numbers tell a stark story – automated bot traffic now makes up 51% of all web traffic in 2024, and it’s the first time bots have outnumbered humans in a decade. AI and big language models have made it easier than ever to make and scale malicious bots. Malicious bots alone account for 37% of all internet traffic, up from 32% in 2023.
Between January 2023 and June 2024, North America faced nearly 9 billion web attacks, far more than the 330 million attacks hitting Europe, the Middle East, Africa, and Asia-Pacific combined. Criminals clearly target regions with strong economies.
Real Cost of Hidden Attacks
The financial damage keeps growing. The average cost of a cyber breach jumped to $4.88 million in 2024, a 10% increase from the previous year. But that’s just the immediate damage – it doesn’t include long-term reputation damage or regulatory fines.
Ransomware attacks through residential proxy networks have become devastating. Manufacturers now represent nearly 30% of publicly extorted ransomware victims globally, a 56% year-over-year increase.
Healthcare organizations get hit the hardest, with average breach costs of nearly $11 million per incident. Criminals know hospitals and clinics will pay quickly to restore critical operations.
The Internet of Things Becomes a Weapon
Cybercriminals systematically compromise everyday devices to build their proxy networks. They either install malicious software before consumers buy devices or infect them during setup when devices download required applications containing backdoors.
Most compromised devices come from China and include TV streaming boxes, digital projectors, car entertainment systems, and digital picture frames. These devices keep working normally while secretly participating in criminal networks.
The BADBOX 2.0 botnet shows how sophisticated these operations have become. Thousands of compromised IoT devices participate in residential proxy services that facilitate everything from password theft to bigger fraud.
Nation-States Join the Game
State-sponsored hackers also use residential proxy networks for espionage and influence operations. The FBI warns that Chinese state-sponsored actors exploit vulnerabilities in home routers to conduct covert campaigns against U.S. infrastructure.
Microsoft data shows password-based attacks make up more than 99% of the 600 million daily identity attacks worldwide. Many of these attacks route through residential proxy networks to avoid detection and attribution.
Fighting Back Against Invisible Enemies
Organizations face an uphill battle defending against these hidden attacks. Traditional IP-based blocking doesn’t work when attacks come from legitimate residential addresses. Security teams must turn to behavior-based detection that analyzes patterns.
Companies using AI and automation in their security operations save an average of $2.22 million per breach compared to those relying on traditional methods. But the problem remains enormous as more devices come online and attackers develop new ways to get into consumer hardware.
Law enforcement agencies have started working together internationally to shut down some proxy service operators, but the distributed nature of residential proxy networks makes complete disruption nearly impossible.
The arms race continues, with criminals constantly finding new ways to hide in plain sight while defenders fight to identify threats without blocking legitimate users.
