Skip to content

T1090.001 Internal Proxy

Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. 1 Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.

By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.

Item Value
ID T1090.001
Sub-techniques T1090.001, T1090.002, T1090.003, T1090.004
Tactics TA0011
Platforms Linux, Windows, macOS
Version 1.0
Created 14 March 2020
Last Modified 15 March 2020

Procedure Examples

ID Name Description
G0087 APT39 APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.2324
S0031 BACKSPACE The “ZJ” variant of BACKSPACE allows “ZJ link” infections with Internet access to relay traffic from “ZJ listen” to a command server.11
S0023 CHOPSTICK CHOPSTICK used a proxy server between victims and the C2 server.7
S0154 Cobalt Strike Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.910
S0502 Drovorub Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.15
S0038 Duqu Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.16
S0512 FatDuke FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.13
G0126 Higaisa Higaisa discovered system proxy settings and used them if available.19
S0009 Hikit Hikit supports peer connections.5
S0260 InvisiMole InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.6
S0265 Kazuar Kazuar has used internal nodes on the compromised network for C2 communications.14
G0032 Lazarus Group Lazarus Group has used a compromised router to serve as a proxy between a victim network’s corporate and restricted segments.21
S1060 Mafalda Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.12
S1059 metaMain metaMain can create a named pipe to listen for and send data to a named pipe-based C2 server.12
S0051 MiniDuke MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.13
S0699 Mythic Mythic can leverage a peer-to-peer C2 profile between agents.3
C0014 Operation Wocao During Operation Wocao, threat actors proxied traffic through multiple infected systems.27
S0556 Pay2Key Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.1718
C0024 SolarWinds Compromise During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.2526
G0041 Strider Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.22
S0603 Stuxnet Stuxnet installs an RPC server for P2P communications.8
G0010 Turla Turla has compromised internal network systems to act as a proxy to forward traffic to C2.20
S0141 Winnti for Windows The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.4

Mitigations

ID Mitigation Description
M1031 Network Intrusion Prevention Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.2

Detection

ID Data Source Data Component
DS0029 Network Traffic Network Connection Creation

References


  1. Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015. 

  2. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. 

  3. Thomas, C. (n.d.). Mythc Documentation. Retrieved March 25, 2022. 

  4. Novetta Threat Research Group. (2015, April 7). Winnti Analysis. Retrieved February 8, 2017. 

  5. Novetta. (n.d.). Operation SMN: Axiom Threat Actor Group Report. Retrieved November 12, 2014. 

  6. Hromcová, Z. (2018, June 07). InvisiMole: Surprisingly equipped spyware, undercover since 2013. Retrieved July 10, 2018. 

  7. ESET. (2016, October). En Route with Sednit - Part 2: Observing the Comings and Goings. Retrieved November 21, 2016. 

  8. Nicolas Falliere, Liam O Murchu, Eric Chien 2011, February W32.Stuxnet Dossier (Version 1.4) Retrieved. 2017/09/22  

  9. Strategic Cyber LLC. (2017, March 14). Cobalt Strike Manual. Retrieved May 24, 2017. 

  10. Strategic Cyber LLC. (2020, November 5). Cobalt Strike: Advanced Threat Tactics for Penetration Testers. Retrieved April 13, 2021. 

  11. FireEye Labs. (2015, April). APT30 AND THE MECHANICS OF A LONG-RUNNING CYBER ESPIONAGE OPERATION. Retrieved May 1, 2015. 

  12. SentinelLabs. (2022, September 22). Metador Technical Appendix. Retrieved April 4, 2023. 

  13. Faou, M., Tartare, M., Dupuy, T. (2019, October). OPERATION GHOST. Retrieved September 23, 2020. 

  14. Accenture. (2020, October). Turla uses HyperStack, Carbon, and Kazuar to compromise government entity. Retrieved December 2, 2020. 

  15. NSA/FBI. (2020, August). Russian GRU 85th GTsSS Deploys Previously Undisclosed Drovorub Malware. Retrieved August 25, 2020. 

  16. Symantec Security Response. (2011, November). W32.Duqu: The precursor to the next Stuxnet. Retrieved September 17, 2015. 

  17. ClearSky. (2020, February 16). Fox Kitten – Widespread Iranian Espionage-Offensive Campaign. Retrieved December 21, 2020. 

  18. Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021. 

  19. Singh, S. Singh, A. (2020, June 11). The Return on the Higaisa APT. Retrieved March 2, 2021. 

  20. Cisco Talos. (2021, September 21). TinyTurla - Turla deploys new malware to keep a secret backdoor on victim machines. Retrieved December 2, 2021. 

  21. Vyacheslav Kopeytsev and Seongsu Park. (2021, February 25). Lazarus targets defense industry with ThreatNeedle. Retrieved October 27, 2021. 

  22. Kaspersky Lab’s Global Research & Analysis Team. (2016, August 8). ProjectSauron: top level cyber-espionage platform covertly extracts encrypted government comms. Retrieved August 17, 2016. 

  23. Hawley et al. (2019, January 29). APT39: An Iranian Cyber Espionage Group Focused on Personal Information. Retrieved February 19, 2019. 

  24. Rusu, B. (2020, May 21). Iranian Chafer APT Targeted Air Transportation and Government in Kuwait and Saudi Arabia. Retrieved May 22, 2020. 

  25. CrowdStrike. (2022, January 27). Early Bird Catches the Wormhole: Observations from the StellarParticle Campaign. Retrieved February 7, 2022. 

  26. Symantec Threat Hunter Team. (2021, January 18). Raindrop: New Malware Discovered in SolarWinds Investigation. Retrieved January 19, 2021. 

  27. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.