Inside the Enterprise Risk Profile of Residential Proxies

2 days ago
3 min read

On July 2nd, 2025, a user known as 'Admirable-Raccoon597' on reddit claims to have downloaded a mouse configuration tool from their official website. Upon noticing suspicious activity, they investigated further and discovered that the software contained a hidden trojan identified as 'Synaptics.exe'. This incident was not isolated; another user reported finding similar malware embedded within the software for another gaming mouse utility tool.

Talk about a mouse becoming a RAT ….

Downloading unapproved software is essentially playing Russian roulette with your enterprise cybersecurity. In the absolute worst-case scenario, it leads to outright malware like the compromised gaming mouse utility that drops a hidden Trojan. In other cases, it introduces a quiet, background resource consumer: a corporate PUA that silently turns an endpoint into a pawn for someone else's network.

Threat Hunting the suspicious traffic

Last week, we discovered a concerning trend: our machine learning model flagged a workstation for establishing connections to numerous, previously unseen ASNs.

The web traffic seemed standard at first, but something felt off. Upon closer inspection, I noticed our EDR attempting to block connections to various unfamiliar domains. Digging deeper, I traced the activity to an executable hidden within the installation directory of a multimedia converter known as "FormatFactory."

And there you have it, the root cause of all suspicious connections

Bright Data (formerly Luminati Networks) operates as an industry-leading platform designed for large-scale public web data collection and scraping. However, the underlying architecture that powers this extensive proxy network raises significant enterprise security and operational questions. The debate over data scraping often centers on the principle that publicly accessible data is fair game, yet website owners frequently disagree, often attempting to mitigate the practice with security measures like Cloudflare CAPTCHAs.

However, these defenses are increasingly ineffective.

The Dark world of Residential Proxies

While providers like Cloudflare routinely challenge or block traffic from known VPNs, data centers, and ISP proxies, services like Bright Data have effectively bypassed these defenses by leveraging residential IPs. They route web-scraping requests through legitimate end-user devices such as laptops and smartphones allowing their traffic to appear as organic, human activity and successfully circumvent CAPTCHA protections.

They achieve this routing by bundling their services with legitimate software, distributing them through various channels:

Mobile SDKs
Desktop SDKs
Compromised Devices
Your Smart TV (yeah, that’s right)

Disclaimer

Your concern?

As someone in your organization decides to install a random unapproved software while ignoring all the disclaimers of a potential nuclear attack for some ad-free experience, such residential proxy tools will start populating your corporate network. The potential risks include:

Increased bandwidth usage
Corporate exit node IPs potentially being blacklisted
Puts your overall security posture at risk

Additionally, EDRs may tag this as a PUA and not a malware so it at times gets away with the ‘warning’ tag.

However, it is important to note that we are not dealing with a typical ‘Nigerian Prince’ here, but with a legitimate, established and legal enterprise. Such companies claim to maintain rigorous KYC (Know Your Customer) protocols to prevent the misuse of their residential proxy network. Most significantly, they operate under the premise of full end-user consent while ensuring that system resources are only consumed during periods of user inactivity.

So technically, you couldn’t call them illegal but simply the transactional cost of using free software.

Turning a blind eye to idle system resources or bandwidth usage in exchange for ad-free software or beyond freemium features might be acceptable for a personal device on a home network, but it presents an unacceptable risk when that host is integrated into a corporate environment.