Skip to content

T1090 Proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. 2 Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

Item Value
ID T1090
Sub-techniques T1090.001, T1090.002, T1090.003, T1090.004
Tactics TA0011
Platforms ESXi, Linux, Network Devices, Windows, macOS
Version 3.2
Created 31 May 2017
Last Modified 24 October 2025

Procedure Examples

ID Name Description
G0096 APT41 APT41 used a tool called CLASSFON to covertly proxy network communications.24
S0456 Aria-body Aria-body has the ability to use a reverse SOCKS proxy module.53
S0347 AuditCred AuditCred can utilize proxy for communications.22
S0245 BADCALL BADCALL functions as a proxy server between the victim and C2 server.29
S1081 BADHATCH BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.30
S0268 Bisonal Bisonal has supported use of a proxy server.54
G0108 Blue Mockingbird Blue Mockingbird has used FRP, ssf, and Venom to establish SOCKS proxy connections.66
C0017 C0017 During C0017, APT41 used the Cloudflare CDN to proxy C2 traffic.58
C0027 C0027 During C0027, Scattered Spider installed the open-source rsocx reverse proxy tool on a targeted ESXi appliance.87
S0348 Cardinal RAT Cardinal RAT can act as a reverse proxy.47
G1021 Cinnamon Tempest Cinnamon Tempest has used a customized version of the Iox port-forwarding and proxy tool.67
G1052 Contagious Interview Contagious Interview has leveraged Astrill VPN for C2.73
G0052 CopyKittens CopyKittens has used the AirVPN service for operational activity.64
S0384 Dridex Dridex contains a backconnect module for tunneling network traffic through a victim’s computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.3334
G1006 Earth Lusca Earth Lusca adopted Cloudflare as a proxy for compromised servers.74
G0117 Fox Kitten Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.707172
S1144 FRP FRP can proxy communications through a server in public IP space to local servers located behind a NAT or firewall.5
S1044 FunnyDream FunnyDream can identify and use configured proxies in a compromised network for C2 communication.45
G0047 Gamaredon Group Gamaredon Group has used the Cloudflare Tunnel client to proxy C2 traffic.78
S1197 GoBear GoBear implements SOCKS5 proxy functionality.31
S0690 Green Lambert Green Lambert can use proxies for C2 traffic.4344
S0246 HARDRAIN HARDRAIN uses the command cmd.exe /c netsh firewall add portopening TCP 443 “adp” and makes the victim machine function as a proxy server.35
S1229 Havoc Havoc has the ability to route HTTP/S communications through designated proxies.21
S0376 HOPLIGHT HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.25
S0040 HTRAN HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.34
S0283 jRAT jRAT can serve as a SOCKS proxy server.42
S1190 Kapeka Kapeka can identify system proxy settings via WinHttpGetIEProxyConfigForCurrentUser() during initialization and utilize these settings for subsequent command and control operations.50
S0487 Kessel Kessel can use a proxy during exfiltration if set in the configuration.36
S1051 KEYPLUG KEYPLUG has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains.58
S0669 KOCTOPUS KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.18
G1004 LAPSUS$ LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.65
S1121 LITTLELAMB.WOOLTEA LITTLELAMB.WOOLTEA has the ability to function as a SOCKS proxy.27
S1141 LunarWeb LunarWeb has the ability to use a HTTP proxy server for C&C communications.56
G0059 Magic Hound Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.77
G1019 MoustachedBouncer MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.68
S1189 Neo-reGeorg Neo-reGeorg has the ability to establish a SOCKS5 proxy on a compromised web server.28
S0108 netsh netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.9
S0198 NETWIRE NETWIRE can implement use of proxies to pivot traffic.14
S0508 ngrok ngrok can be used to proxy connections to machines located behind NAT or firewalls.76
C0048 Operation MidnightEclipse During Operation MidnightEclipse, threat actors used the GO Simple Tunnel reverse proxy tool.80
C0013 Operation Sharpshooter For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.88
C0014 Operation Wocao During Operation Wocao, threat actors used a custom proxy tool called “Agent” which has support for multiple hops.84
S0435 PLEAD PLEAD has the ability to proxy network communications.32
G1005 POLONIUM POLONIUM has used the AirVPN service for operational activity.64
S0378 PoshC2 PoshC2 contains modules that allow for use of proxies in command and control.10
S0262 QuasarRAT QuasarRAT can communicate over a reverse proxy using SOCKS5.1112
S0629 RainyDay RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.46
S1212 RansomHub RansomHub can use a proxy to connect to remote SFTP servers.17
C0047 RedDelta Modified PlugX Infection Chain Operations Mustang Panda proxied communication through the Cloudflare CDN service during RedDelta Modified PlugX Infection Chain Operations.79
C0056 RedPenguin During RedPenguin, UNC3886 used malware capable of establishing a SOCKS proxy connection to a specified IP and port.8382
S1187 reGeorg reGeorg can establish an HTTP or SOCKS proxy to tunnel data in and out of a network.413940
S0332 Remcos Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.8
S1210 Sagerunex Sagerunex uses several proxy configuration settings to ensure connectivity.13
C0059 Salesforce Data Exfiltration During Salesforce Data Exfiltration, threat actors used Mullvad VPN IPs to proxy voice phishing calls.81
S1099 Samurai Samurai has the ability to proxy connections to specified remote IPs and ports through a a proxy module.57
G0034 Sandworm Team Sandworm Team’s BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.62
G1015 Scattered Spider Scattered Spider has used proxy networks to hamper detection and has installed legitimate proxy tools on VMware vCenter and adversary-controlled VMs.7576
S0461 SDBbot SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.19
C0058 SharePoint ToolShell Exploitation During SharePoint ToolShell Exploitation, threat actors used Fast Reverse Proxy to communicate with C2.8685
S0273 Socksbot Socksbot can start SOCKS proxy threads.48
S0615 SombRAT SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.20
S0436 TSCookie TSCookie has the ability to proxy communications with command and control (C2) servers.37
G0010 Turla Turla RPC backdoors have included local UPnP RPC proxies.63
S0263 TYPEFRAME A TYPEFRAME variant can force the compromised system to function as a proxy server.38
S0386 Ursnif Ursnif has used a peer-to-peer (P2P) network for C2.5152
S0207 Vasport Vasport is capable of tunneling though a proxy.49
G1017 Volt Typhoon Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.606159
S0670 WarzoneRAT WarzoneRAT has the capability to act as a reverse proxy.26
G0124 Windigo Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.69
S0117 XTunnel XTunnel relays traffic between a C2 server and a victim.55
S1114 ZIPLINE ZIPLINE can create a proxy server on compromised hosts.1615
S0412 ZxShell ZxShell can set up an HTTP or SOCKS proxy.2423

Mitigations

ID Mitigation Description
M1037 Filter Network Traffic Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques like Domain Fronting.
M1031 Network Intrusion Prevention Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. 1
M1020 SSL/TLS Inspection If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.

References

  1. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016. ↩

  2. Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015. ↩

  3. Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 17, 2024. ↩

  4. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019. ↩

  5. fatedier. (n.d.). What is frp?. Retrieved July 10, 2024. ↩

  6. Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020. ↩

  7. Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020. ↩

  8. Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018. ↩

  9. Kaspersky Lab’s Global Research and Analysis Team. (2017, February 8). Fileless attacks against enterprise networks. Retrieved February 8, 2017. ↩

  10. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019. ↩

  11. MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018. ↩

  12. Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018. ↩

  13. Joey Chen, Cisco Talos. (2025, February 27). Lotus Blossom espionage group targets multiple industries with different versions of Sagerunex and hacking tools. Retrieved March 15, 2025. ↩

  14. Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021. ↩

  15. Lin, M. et al. (2024, January 31). Cutting Edge, Part 2: Investigating Ivanti Connect Secure VPN Zero-Day Exploitation. Retrieved February 27, 2024. ↩

  16. McLellan, T. et al. (2024, January 12). Cutting Edge: Suspected APT Targets Ivanti Connect Secure VPN in New Zero-Day Exploitation. Retrieved February 27, 2024. ↩

  17. Alfano, V. et al. (2025, February 12). RansomHub Never Sleeps Episode 1: The evolution of modern ransomware. Retrieved March 17, 2025. ↩

  18. Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024. ↩

  19. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020. ↩

  20. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021. ↩

  21. Ungur, P. (n.d.). HAVOC. Retrieved August 4, 2025. ↩

  22. Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018. ↩

  23. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019. ↩

  24. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. ↩↩

  25. US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019. ↩

  26. Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021. ↩

  27. Lin, M. et al. (2024, February 27). Cutting Edge, Part 3: Investigating Ivanti Connect Secure VPN Exploitation and Persistence Attempts. Retrieved March 1, 2024. ↩

  28. L-Codes. (2019). Neo-reGeorg. Retrieved December 4, 2024. ↩

  29. US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018. ↩

  30. Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021. ↩

  31. Jiho Kim & Sebin Lee, S2W. (2024, February 7). Kimsuky disguised as a Korean company signed with a valid certificate to distribute Troll Stealer (English ver.). Retrieved January 17, 2025. ↩

  32. Tomonaga, S. (2018, June 8). PLEAD Downloader Used by BlackTech. Retrieved May 6, 2020. ↩

  33. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019. ↩

  34. Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021. ↩

  35. US-CERT. (2018, February 05). Malware Analysis Report (MAR) - 10135536-F. Retrieved June 11, 2018. ↩

  36. Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020. ↩

  37. Tomonaga, S.. (2019, September 18). Malware Used by BlackTech after Network Intrusion. Retrieved May 6, 2020. ↩

  38. US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018. ↩

  39. FortiGard Labs. (2019, March 12). ReGeorg.HTTP.Tunnel. Retrieved December 3, 2024. ↩

  40. Mandiant. (2022, May 2). UNC3524: Eye Spy on Your Email. Retrieved August 17, 2023. ↩

  41. xl7dev. (2016). reGeorg-master. Retrieved December 3, 2024. ↩

  42. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019. ↩

  43. Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022. ↩

  44. Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024. ↩

  45. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022. ↩

  46. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021. ↩

  47. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018. ↩

  48. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018. ↩

  49. Zhou, R. (2012, May 15). Backdoor.Vasport. Retrieved February 22, 2018. ↩

  50. Mohammad Kazem Hassan Nejad, WithSecure. (2024, April 17). KAPEKA A novel backdoor spotted in Eastern Europe. Retrieved January 6, 2025. ↩

  51. NJCCIC. (2016, September 27). Ursnif. Retrieved September 12, 2024. ↩

  52. Proofpoint Staff. (2016, August 25). Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality. Retrieved June 5, 2019. ↩

  53. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020. ↩

  54. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022. ↩

  55. Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016. ↩

  56. Jurčacko, F. (2024, May 15). To the Moon and back(doors): Lunar landing in diplomatic missions. Retrieved June 26, 2024. ↩

  57. Dedola, G. (2022, June 21). APT ToddyCat. Retrieved January 3, 2024. ↩

  58. Rufus Brown, Van Ta, Douglas Bienstock, Geoff Ackerman, John Wolfram. (2022, March 8). Does This Look Infected? A Summary of APT41 Targeting U.S. State Governments. Retrieved July 8, 2022. ↩↩

  59. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024. ↩

  60. Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023. ↩

  61. NSA et al. (2023, May 24). People’s Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023. ↩

  62. Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020. ↩

  63. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019. ↩

  64. Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022. ↩↩

  65. MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022. ↩

  66. Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020. ↩

  67. Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023. ↩

  68. Faou, M. (2023, August 10). MoustachedBouncer: Espionage against foreign diplomats in Belarus. Retrieved September 25, 2023. ↩

  69. Bilodeau, O., Bureau, M., Calvet, J., Dorais-Joncas, A., Léveillé, M., Vanheuverzwijn, B. (2014, March 18). Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign. Retrieved February 10, 2021. ↩

  70. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020. ↩

  71. ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020. ↩

  72. Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021. ↩

  73. Insikt Group. (2025, February 13). Inside the Scam: North Korea’s IT Worker Threat. Retrieved October 17, 2025. ↩

  74. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022. ↩

  75. Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025. ↩

  76. CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024. ↩

  77. DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023. ↩

  78. Rusnák, Z. (2024, September 26). Cyberespionage the Gamaredon way: Analysis of toolset used to spy on Ukraine in 2022 and 2023. Retrieved October 30, 2024. ↩

  79. Insikt Group. (2025, January 9). Chinese State-Sponsored RedDelta Targeted Taiwan, Mongolia, and Southeast Asia with Adapted PlugX Infection Chain. Retrieved January 14, 2025. ↩

  80. Volexity Threat Research. (2024, April 12). Zero-Day Exploitation of Unauthenticated Remote Code Execution Vulnerability in GlobalProtect (CVE-2024-3400). Retrieved November 20, 2024. ↩

  81. Google Threat Intelligence Group. (2025, June 4). The Cost of a Call: From Voice Phishing to Data Extortion. Retrieved October 22, 2025. ↩

  82. Juniper Networks, Cybersecurity R&D. (2025, March 11). The RedPenguin Malware Incident. Retrieved June 24, 2025. ↩

  83. Lamparski, L. et al. (2025, March 11). Ghost in the Router: China-Nexus Espionage Actor UNC3886 Targets Juniper Routers. Retrieved June 24, 2025. ↩

  84. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020. ↩

  85. ESET Research. (2025, July 24). ToolShell: An all-you-can-eat buffet for threat actors. Retrieved October 15, 2025. ↩

  86. Microsoft Threat Intelligence. (2025, July 22). Disrupting active exploitation of on-premises SharePoint vulnerabilities. Retrieved October 15, 2025. ↩

  87. Parisi, T. (2022, December 2). Not a SIMulation: CrowdStrike Investigations Reveal Intrusion Campaign Targeting Telco and BPO Companies. Retrieved June 30, 2023. ↩

  88. I. Ilascu. (2019, March 3). Op ‘Sharpshooter’ Connected to North Korea’s Lazarus Group. Retrieved September 26, 2022. ↩