AT&T's security team (Alien Labs) publishes malware research, threat analysis, and security how-tos, including on Linux malware and proxy abuse.
HN links it for technical details on threat reports like the Great Cannon redeployment and Jaskago malware, and for the Open Threat Exchange.
>> The more I learn about the networking side the more interested I am in how to secure this, and I'm less interested in writing code.
Be warned, most 'security' jobs are running scripts and programs and filling out checklists. If you were interested in writing code I'd suggest books like Reversing: Secrets of Reverse Engineering or Hacking: The Art of Exploitation
That said, a good way to get into it is to find any kind of local user groups, either in industries or at colleges, and find ones that offer security classes and do capture the flag (CTF) events.
Here's one in Michigan, for example:
https://www.merit.edu/security/training/
This is a good way to get familiar with the tools you would be using and even better, a good way to meet other people in your area who might know of job openings and such.
Here are some details on CTF events:
https://cybersecurity.att.com/blogs/security-essentials/capture-the-flag-ctf-what-is-it-for-a-newbie
The discovering group (AT&T Alien Labs) wrote a pretty useful blog post "Behind the scenes: JaskaGO’s coordinated strike on macOS and Windows"[0], which goes into interesting detail on how it behaves (fake error message popup, the anti-vm detection, the trivial tasks if it thinks it's in a VM, the malicious tasks it can attempt if prompted by the command & control).
TechRadar summarizes thehackernews which summarizes the blog post.
[0]: https://cybersecurity.att.com/blogs/labs-research/behind-the-scenes-jaskagos-coordinated-strike-on-macos-and-windows
> Have you ever had to debug a "blackbox" before, Application code or hardware that you had really nothing to do with and had to figure out how in the hell it works?
I suppose so, yes, but probably not to the extent required in some of these challenges.
I just read through https://cybersecurity.att.com/blogs/security-essentials/capture-the-flag-ctf-what-is-it-for-a-newbie and some of the accompanying write ups[0] on Github which was very insightful.
[0]: https://github.com/1337pwnie/ctf-writeups/tree/master/2017/UIUCTF
It's unlikely that companies would pay for such data, as it is shared for free in places like FB ThreatExchange or https://cybersecurity.att.com/open-threat-exchange (and some others that are more secret)
You could potentially otherwise check https://www.projecthoneypot.org/
This is the ancestor of Cloudflare and still actively flagging IPs for bad bots, which is probably a source in Cloudflare itself.
>>The proxy application and most of the malware delivering it are packed using Inno Setup, a free and popular Windows installer.<<
ProxyNation: The dark nexus between proxy apps and malware
https://cybersecurity.att.com/blogs/labs-research/proxynation-the-dark-nexus-between-proxy-apps-and-malware?ref=thefinalhop.com
https://www.theguardian.com/commentisfree/2015/feb/20/att-price-on-privacy
It’s even explained on their site: https://cybersecurity.att.com/blogs/security-essentials/what-is-deep-packet-inspection
Justification: to keep you safe!1