Procedure examples

Salt Typhoon has modified device configurations to create and use Generic Routing Encapsulation (GRE) tunnels.

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.

FIN7 has tunneled C2 traffic via OpenSSH.

Mustang Panda has leveraged OpenSSH (sshd.exe) to execute commands, transfer files and spread across the environment communicating over SMB port 445.

Scattered Spider has installed protocol-tunneling tools on VMware vCenter and adversary-controlled VMs, including Teleport.sh, Chisel (configured to communicate with trycloudflare[.]com subdomains), MobaXterm, ngrok, Pinggy, and Teleport.

OilRig has used the Plink utility and other tools to create tunnels to C2 servers.

Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.

Cinnamon Tempest has used the Iox and NPS proxy and tunneling tools in combination create multiple connections through a single tunnel.

Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.

Ember Bear has used ProxyChains to tunnel protocols to internal networks.

Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as ngrok and custom tool SSHMinion.

Cobalt Group has used the Plink utility to create SSH tunnels.

VOID MANTICORE has used tunneling tools to facilitate destructive attacks on compromised devices.

Magic Hound has used Plink to tunnel RDP over SSH.

FIN13 has utilized web shells and Java tools for tunneling capabilities to and from compromised assets.