Procedure examples

reGeorg can establish an HTTP or SOCKS proxy to tunnel data in and out of a network.

Ursnif has used a peer-to-peer (P2P) network for C2.

RansomHub can use a proxy to connect to remote SFTP servers.

LITTLELAMB.WOOLTEA has the ability to function as a SOCKS proxy.

Havoc has the ability to route HTTP/S communications through designated proxies.

AuditCred can utilize proxy for communications.

RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.

NETWIRE can implement use of proxies to pivot traffic.

Aria-body has the ability to use a reverse SOCKS proxy module.

BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.

SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.

HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.

Green Lambert can use proxies for C2 traffic.

Bisonal has supported use of a proxy server.

KEYPLUG has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains.

XTunnel relays traffic between a C2 server and a victim.

TSCookie has the ability to proxy communications with command and control (C2) servers.

A TYPEFRAME variant can force the compromised system to function as a proxy server.

Sagerunex uses several proxy configuration settings to ensure connectivity.

SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.

GoBear implements SOCKS5 proxy functionality.

BADCALL functions as a proxy server between the victim and C2 server.

Kapeka can identify system proxy settings via `WinHttpGetIEProxyConfigForCurrentUser()` during initialization and utilize these settings for subsequent command and control operations.

Samurai has the ability to proxy connections to specified remote IPs and ports through a a proxy module.

PLEAD has the ability to proxy network communications.

Cardinal RAT can act as a reverse proxy.

Neo-reGeorg has the ability to establish a SOCKS5 proxy on a compromised web server.

HARDRAIN uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.

FunnyDream can identify and use configured proxies in a compromised network for C2 communication.

Kessel can use a proxy during exfiltration if set in the configuration.

ZxShell can set up an HTTP or SOCKS proxy.

ZIPLINE can create a proxy server on compromised hosts.

KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.

LunarWeb has the ability to use a HTTP proxy server for C&C communications.

Socksbot can start SOCKS proxy threads.

jRAT can serve as a SOCKS proxy server.

Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.

Vasport is capable of tunneling though a proxy.

WarzoneRAT has the capability to act as a reverse proxy.

ngrok can be used to proxy connections to machines located behind NAT or firewalls.

FRP can proxy communications through a server in public IP space to local servers located behind a NAT or firewall.

PoshC2 contains modules that allow for use of proxies in command and control.

netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.

Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.

HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.

QuasarRAT can communicate over a reverse proxy using SOCKS5.

Kali365 has leveraged Cloudflare workers as reverse proxy infrastructure.