Procedure examples

NETWIRE can implement use of proxies to pivot traffic.

Aria-body has the ability to use a reverse SOCKS proxy module.

BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.

SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.

HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.

Green Lambert can use proxies for C2 traffic.

Bisonal has supported use of a proxy server.

KEYPLUG has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains.

XTunnel relays traffic between a C2 server and a victim.

TSCookie has the ability to proxy communications with command and control (C2) servers.

A TYPEFRAME variant can force the compromised system to function as a proxy server.

Sagerunex uses several proxy configuration settings to ensure connectivity.

SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.

GoBear implements SOCKS5 proxy functionality.

BADCALL functions as a proxy server between the victim and C2 server.

Kapeka can identify system proxy settings via `WinHttpGetIEProxyConfigForCurrentUser()` during initialization and utilize these settings for subsequent command and control operations.

Samurai has the ability to proxy connections to specified remote IPs and ports through a a proxy module.

PLEAD has the ability to proxy network communications.

Cardinal RAT can act as a reverse proxy.

Neo-reGeorg has the ability to establish a SOCKS5 proxy on a compromised web server.

HARDRAIN uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.

FunnyDream can identify and use configured proxies in a compromised network for C2 communication.

Kessel can use a proxy during exfiltration if set in the configuration.

ZxShell can set up an HTTP or SOCKS proxy.

ZIPLINE can create a proxy server on compromised hosts.

KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.

LunarWeb has the ability to use a HTTP proxy server for C&C communications.

Socksbot can start SOCKS proxy threads.

jRAT can serve as a SOCKS proxy server.

Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.

Vasport is capable of tunneling though a proxy.

WarzoneRAT has the capability to act as a reverse proxy.

ngrok can be used to proxy connections to machines located behind NAT or firewalls.

FRP can proxy communications through a server in public IP space to local servers located behind a NAT or firewall.

PoshC2 contains modules that allow for use of proxies in command and control.

netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.

Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.

HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.

QuasarRAT can communicate over a reverse proxy using SOCKS5.

Kali365 has leveraged Cloudflare workers as reverse proxy infrastructure.

Ninja can proxy C2 communications including to and from internal agents without internet connectivity.

BRICKSTORM has leveraged SOCKS Proxy to pivot into victim networks in attempts to resemble legitimate administrative traffic.

Stuxnet installs an RPC server for P2P communications.

Gomir can start a reverse proxy to initiate connections to arbitrary endpoints in victim networks.

Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.

InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.

Kazuar has used internal nodes on the compromised network for C2 communications.

FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.

MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.

Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.