Procedure examples

Socksbot can start SOCKS proxy threads.

jRAT can serve as a SOCKS proxy server.

Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.

Vasport is capable of tunneling though a proxy.

WarzoneRAT has the capability to act as a reverse proxy.

ngrok can be used to proxy connections to machines located behind NAT or firewalls.

FRP can proxy communications through a server in public IP space to local servers located behind a NAT or firewall.

PoshC2 contains modules that allow for use of proxies in command and control.

netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.

Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.

HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.

QuasarRAT can communicate over a reverse proxy using SOCKS5.

Kali365 has leveraged Cloudflare workers as reverse proxy infrastructure.

During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.

During APT28 Nearest Neighbor Campaign, APT28 used the built-in netsh portproxy command to create internal proxies on compromised systems.

During Operation Wocao, threat actors proxied traffic through multiple infected systems.

Volt Typhoon has used the built-in netsh `port proxy` command to create proxies on compromised systems to facilitate access.

Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.

APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.

Higaisa discovered system proxy settings and used them if available.

Turla has compromised internal network systems to act as a proxy to forward traffic to C2.

Lotus Blossom has used publicly available tools such as the Venom proxy tool to proxy traffic out of victim environments.

Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.

Velvet Ant has tunneled traffic from victims through an internal, compromised host to proxy communications to command and control nodes.

FIN13 has utilized a proxy tool to communicate between compromised assets.

Ninja can proxy C2 communications including to and from internal agents without internet connectivity.

BRICKSTORM has leveraged SOCKS Proxy to pivot into victim networks in attempts to resemble legitimate administrative traffic.

Stuxnet installs an RPC server for P2P communications.

Gomir can start a reverse proxy to initiate connections to arbitrary endpoints in victim networks.

Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.

InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.

Kazuar has used internal nodes on the compromised network for C2 communications.

FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.

MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.

Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.

GlassWorm has leveraged peer-to-peer software to facilitate communications within the victim network to include the software WebRTC. GlassWorm has also established a SOCKS proxy to interact with victim devices that also acted as a proxy node for follow-on behaviors.

Hikit supports peer connections.

Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.

HiddenFace can act as an internal HTTP proxy within the targeted environment.

Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.

CHOPSTICK used a proxy server between victims and the C2 server.

The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.

metaMain can create a named pipe to listen for and send data to a named pipe-based C2 server.

StarProxy has proxied traffic between infected devices and their C2 servers.

The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.

Sliver has a built-in SOCKS5 proxying capability allowing for Sliver clients to proxy network traffic through other clients within a victim network.

Mythic can leverage a peer-to-peer C2 profile between agents.

Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.

Quad7 Activity has initialized SOCKS5 proxies on compromised devices.

GALLIUM used a modified version of HTRAN to redirect connections between networks.