ATT&CKProcedure examples

Procedure examples

Real-world descriptions of how a group, tool or campaign used a technique.

Technique: T1090.003×

23 examples

Technique	Used by	Procedure example
T1090.003 Multi-hop Proxy	MalwareNinja	Ninja has the ability to use a proxy chain with up to 255 hops when using TCP. Kaspersky ToddyCat June 2022
T1090.003 Multi-hop Proxy	MalwareUrsnif	Ursnif has used Tor for C2. NJCCIC Ursnif Sept 2016 ProofPoint Ursnif Aug 2016
T1090.003 Multi-hop Proxy	MalwareStrongPity	StrongPity can use multiple layers of proxy servers to hide terminal nodes in its infrastructure. Bitdefender StrongPity June 2020
T1090.003 Multi-hop Proxy	MalwareGreyEnergy	GreyEnergy has used Tor relays for Command and Control servers. ESET GreyEnergy Oct 2018
T1090.003 Multi-hop Proxy	MalwareBOLDMOVE	BOLDMOVE is capable of relaying traffic from command and control servers to follow-on systems. Google Cloud BOLDMOVE 2023
T1090.003 Multi-hop Proxy	MalwareSystemBC	SystemBC has used multiple proxy layers, such as SOCKS5 and Tor, for C2 communication. SystemBC has also leveraged Tor for encrypting and concealing C2 traffic. The server component of SystemBC has used SOCKS5 for C2 communication. BlackBasta HarmonProofpoint_SystemBC_Aug2019 SophosGnGal_SystemBC_Dec2020 TrumanKroll_SYSTEMBCServer_Jan2024
T1090.003 Multi-hop Proxy	MalwareKeydnap	Keydnap uses a copy of tor2web proxy for HTTPS communications. synack 2016 review
T1090.003 Multi-hop Proxy	MalwareSiloscape	Siloscape uses Tor to communicate with C2. Unit 42 Siloscape Jun 2021
T1090.003 Multi-hop Proxy	MalwareNGLite	NGLite has abused NKN infrastructure for its C2 communication. NGLite Trojan
T1090.003 Multi-hop Proxy	MalwareWannaCry	WannaCry uses Tor for command and control traffic. SecureWorks WannaCry Analysis
T1090.003 Multi-hop Proxy	MalwareUroburos	Uroburos can use implants on multiple compromised machines to proxy communications through its worldwide P2P network. Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023
T1090.003 Multi-hop Proxy	MalwareAttor	Attor has used Tor for C2 communication. ESET Attor Oct 2019
T1090.003 Multi-hop Proxy	MalwareKobalos	Kobalos can chain together multiple compromised machines as proxies to reach their final targets. ESET Kobalos Feb 2021 ESET Kobalos Jan 2021
T1090.003 Multi-hop Proxy	MalwareCyclops Blink	Cyclops Blink has used Tor nodes for C2 traffic. NCSC CISA Cyclops Blink Advisory February 2022
T1090.003 Multi-hop Proxy	MalwareNKAbuse	NKAbuse has abused the NKN public blockchain protocol for its C2 communications. NKAbuse BC NKAbuse SL
T1090.003 Multi-hop Proxy	MalwareIndustroyer	Industroyer used Tor nodes for C2. Dragos Crashoverride 2017
T1090.003 Multi-hop Proxy	MalwareDridex	Dridex can use multiple layers of proxy servers to hide terminal nodes in its infrastructure. Checkpoint Dridex Jan 2021
T1090.003 Multi-hop Proxy	MalwareDok	Dok downloads and installs Tor via homebrew. objsee mac malware 2017
T1090.003 Multi-hop Proxy	MalwareMacSpy	MacSpy uses Tor for command and control. objsee mac malware 2017
T1090.003 Multi-hop Proxy	ToolFRP	The FRP client can be configured to connect to the server through a proxy. FRP GitHub
T1090.003 Multi-hop Proxy	ToolAsyncRAT	AsyncRAT can proxy C2 through a Tor client. ESET MirrorFace 2025
T1090.003 Multi-hop Proxy	ToolTor	Traffic traversing the Tor network will be forwarded to multiple nodes before exiting the Tor network and continuing on to its intended destination. Dingledine Tor The Second-Generation Onion Router
T1090.003 Multi-hop Proxy	MalwareMini Shai-Hulud	Mini Shai-Hulud has the ability to exfiltrate stolen credentials via the Session messenger network. Wiz Mini Shai-Hulud MAY 2026

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.