Procedure examples

Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.

APT41 used a tool called CLASSFON to covertly proxy network communications.

MuddyWater has used NordVPN to proxy phishing emails, making them appear to originate from France.

Gamaredon Group has used the Cloudflare Tunnel client to proxy C2 traffic.

Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.

Scattered Spider has used proxy networks to hamper detection and has installed legitimate proxy tools on VMware vCenter and adversary-controlled VMs.

Contagious Interview has leveraged Astrill VPN for C2.

Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.

POLONIUM has used the AirVPN service for operational activity.

MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.

Blue Mockingbird has used FRP, ssf, and Venom to establish SOCKS proxy connections.

Turla RPC backdoors have included local UPnP RPC proxies.

Cinnamon Tempest has used a customized version of the Iox port-forwarding and proxy tool.

MirrorFace has used the GO Simple Tunnel (GOST) proxy tool.

Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.

Earth Lusca adopted Cloudflare as a proxy for compromised servers.

LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.

CopyKittens has used the AirVPN service for operational activity.

Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.