An active campaign is targeting vulnerable SSH servers to covertly enlist them into a proxy network, allowing threat actors to leverage the victim's unused bandwidth for different services while reducing the chances of detection. The anonymity provided by proxyware services can also be exploited by malicious actors to hide the source of their attacks.