Procedure examples

Volt Typhoon has used the built-in netsh `port proxy` command to create proxies on compromised systems to facilitate access.

Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.

APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.

Higaisa discovered system proxy settings and used them if available.

Turla has compromised internal network systems to act as a proxy to forward traffic to C2.

Lotus Blossom has used publicly available tools such as the Venom proxy tool to proxy traffic out of victim environments.

Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.

Velvet Ant has tunneled traffic from victims through an internal, compromised host to proxy communications to command and control nodes.

FIN13 has utilized a proxy tool to communicate between compromised assets.