Procedure examples

GlassWorm has leveraged peer-to-peer software to facilitate communications within the victim network to include the software WebRTC. GlassWorm has also established a SOCKS proxy to interact with victim devices that also acted as a proxy node for follow-on behaviors.

Hikit supports peer connections.

Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.

HiddenFace can act as an internal HTTP proxy within the targeted environment.

Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.

CHOPSTICK used a proxy server between victims and the C2 server.

The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.

metaMain can create a named pipe to listen for and send data to a named pipe-based C2 server.

StarProxy has proxied traffic between infected devices and their C2 servers.

The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.

Sliver has a built-in SOCKS5 proxying capability allowing for Sliver clients to proxy network traffic through other clients within a victim network.

Mythic can leverage a peer-to-peer C2 profile between agents.

Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.

TrickBot has been known to reach a command and control server via one of nine proxy IP addresses.

InvisiMole InvisiMole can identify proxy servers used by the victim and use them for C2 communication.

QUIETEXIT can proxy traffic via SOCKS.

Okrum can identify proxy servers configured and used by the victim, and use it to make HTTP requests to C2 its server.

Regin leveraged several compromised universities as proxies to obscure its origin.

ShimRat can use pre-configured HTTP proxies.

The Winnti for Windows HTTP/S C2 mode can make use of an external proxy.

POWERSTATS has connected to C2 servers through proxies.

QakBot has a module that can proxy C2 communications.

evilginx2 can route traffic via SOCKS5 and HTTP(S) proxies between an intended phishing victim's machine and legitimate websites.

Mythic can leverage a modified SOCKS5 proxy to tunnel egress C2 traffic.

Ninja has the ability to use a proxy chain with up to 255 hops when using TCP.

Ursnif has used Tor for C2.

StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.

GreyEnergy has used Tor relays for Command and Control servers.

BOLDMOVE is capable of relaying traffic from command and control servers to follow-on systems.

SystemBC has used multiple proxy layers, such as SOCKS5 and Tor, for C2 communication. SystemBC has also leveraged Tor for encrypting and concealing C2 traffic. The server component of SystemBC has used SOCKS5 for C2 communication.

Keydnap uses a copy of tor2web proxy for HTTPS communications.

Siloscape uses Tor to communicate with C2.

NGLite has abused NKN infrastructure for its C2 communication.

WannaCry uses Tor for command and control traffic.

Uroburos can use implants on multiple compromised machines to proxy communications through its worldwide P2P network.

Attor has used Tor for C2 communication.

Kobalos can chain together multiple compromised machines as proxies to reach their final targets.

Cyclops Blink has used Tor nodes for C2 traffic.

NKAbuse has abused the NKN public blockchain protocol for its C2 communications.

Industroyer used Tor nodes for C2.

Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure.

Dok downloads and installs Tor via homebrew.

MacSpy uses Tor for command and control.

The FRP client can be configured to connect to the server through a proxy.

AsyncRAT can proxy C2 through a Tor client.

Traffic traversing the Tor network will be forwarded to multiple nodes before exiting the Tor network and continuing on to its intended destination.

Mini Shai-Hulud has the ability to exfiltrate stolen credentials via the Session messenger network.

SMOKEDHAM has used a fronted domain to obfuscate its hard-coded C2 server domain.

Cobalt Strike has the ability to accept a value for HTTP Host Header to enable domain fronting.

meek uses Domain Fronting to disguise the destination of network traffic as another server that is hosted in the same Content Delivery Network (CDN) as the intended destination.