Procedure examples

Gamaredon Group has used the Cloudflare Tunnel client to proxy C2 traffic.

Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.

Scattered Spider has used proxy networks to hamper detection and has installed legitimate proxy tools on VMware vCenter and adversary-controlled VMs.

Contagious Interview has leveraged Astrill VPN for C2.

Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.

POLONIUM has used the AirVPN service for operational activity.

MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.

Blue Mockingbird has used FRP, ssf, and Venom to establish SOCKS proxy connections.

Turla RPC backdoors have included local UPnP RPC proxies.

Cinnamon Tempest has used a customized version of the Iox port-forwarding and proxy tool.

MirrorFace has used the GO Simple Tunnel (GOST) proxy tool.

Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.

Earth Lusca adopted Cloudflare as a proxy for compromised servers.

LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.

CopyKittens has used the AirVPN service for operational activity.

Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.

reGeorg can establish an HTTP or SOCKS proxy to tunnel data in and out of a network.

Ursnif has used a peer-to-peer (P2P) network for C2.

RansomHub can use a proxy to connect to remote SFTP servers.

LITTLELAMB.WOOLTEA has the ability to function as a SOCKS proxy.

Havoc has the ability to route HTTP/S communications through designated proxies.

AuditCred can utilize proxy for communications.

RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.

NETWIRE can implement use of proxies to pivot traffic.

Aria-body has the ability to use a reverse SOCKS proxy module.

BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.

SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.

HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.

Green Lambert can use proxies for C2 traffic.

Bisonal has supported use of a proxy server.

KEYPLUG has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains.

XTunnel relays traffic between a C2 server and a victim.

TSCookie has the ability to proxy communications with command and control (C2) servers.

A TYPEFRAME variant can force the compromised system to function as a proxy server.

Sagerunex uses several proxy configuration settings to ensure connectivity.

SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.

GoBear implements SOCKS5 proxy functionality.

BADCALL functions as a proxy server between the victim and C2 server.

Kapeka can identify system proxy settings via `WinHttpGetIEProxyConfigForCurrentUser()` during initialization and utilize these settings for subsequent command and control operations.

Samurai has the ability to proxy connections to specified remote IPs and ports through a a proxy module.

PLEAD has the ability to proxy network communications.

Cardinal RAT can act as a reverse proxy.

Neo-reGeorg has the ability to establish a SOCKS5 proxy on a compromised web server.

HARDRAIN uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.

FunnyDream can identify and use configured proxies in a compromised network for C2 communication.

Kessel can use a proxy during exfiltration if set in the configuration.

ZxShell can set up an HTTP or SOCKS proxy.

ZIPLINE can create a proxy server on compromised hosts.

KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.

LunarWeb has the ability to use a HTTP proxy server for C&C communications.