Proxy

APT41 used a tool called CLASSFON to covertly proxy network communications.^[2]

Aria-body has the ability to use a reverse SOCKS proxy module.^[3]

AuditCred can utilize proxy for communications.^[4]

BADCALL functions as a proxy server between the victim and C2 server.^[5]

BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.^[6]

Bisonal has supported use of a proxy server.^[7]

Blue Mockingbird has used FRP, ssf, and Venom to establish SOCKS proxy connections.^[8]

During C0017, APT41 used the Cloudflare CDN to proxy C2 traffic.^[9]

During C0027, Scattered Spider installed the open-source rsocx reverse proxy tool on a targeted ESXi appliance.^[10]

Cardinal RAT can act as a reverse proxy.^[11]

Cinnamon Tempest has used a customized version of the Iox port-forwarding and proxy tool.^[12]

CopyKittens has used the AirVPN service for operational activity.^[13]

Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.^[14][15]

Earth Lusca adopted Cloudflare as a proxy for compromised servers.^[16]

Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.^[17][18][19]

FRP can proxy communications through a server in public IP space to local servers located behind a NAT or firewall.^[20]

FunnyDream can identify and use configured proxies in a compromised network for C2 communication.^[21]

Green Lambert can use proxies for C2 traffic.^[22][23]

HARDRAIN uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.^[24]

HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.^[25]

HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.^[26][27]

jRAT can serve as a SOCKS proxy server.^[28]

Kessel can use a proxy during exfiltration if set in the configuration.^[29]

KEYPLUG has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains.^[9]

KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.^[30]

LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.^[31]

LITTLELAMB.WOOLTEA has the ability to function as a SOCKS proxy.^[32]

LunarWeb has the ability to use a HTTP proxy server for C&C communications.^[33]

Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.^[34]

MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.^[35]

netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.^[36]

NETWIRE can implement use of proxies to pivot traffic.^[37]

ngrok can be used to proxy connections to machines located behind NAT or firewalls.^[38][39]

For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.^[40]

During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.^[41]

PLEAD has the ability to proxy network communications.^[42]

POLONIUM has used the AirVPN service for operational activity.^[13]

PoshC2 contains modules that allow for use of proxies in command and control.^[43]

QuasarRAT can communicate over a reverse proxy using SOCKS5.^[44][45]

RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.^[46]

Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.^[47]

Samurai has the ability to proxy connections to specified remote IPs and ports through a a proxy module.^[48]

Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.^[49]

SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.^[50]

Socksbot can start SOCKS proxy threads.^[51]

SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.^[52]

TSCookie has the ability to proxy communications with command and control (C2) servers.^[53]

Turla RPC backdoors have included local UPnP RPC proxies.^[54]

A TYPEFRAME variant can force the compromised system to function as a proxy server.^[55]

Ursnif has used a peer-to-peer (P2P) network for C2.^[56][57]

Vasport is capable of tunneling though a proxy.^[58]

Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.^[59][60][61]

WarzoneRAT has the capability to act as a reverse proxy.^[62]

Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.^[63]

XTunnel relays traffic between a C2 server and a victim.^[64]

ZIPLINE can create a proxy server on compromised hosts.^[65][66]

ZxShell can set up an HTTP or SOCKS proxy.^[2][67]

Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques like Domain Fronting.

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. ^[68]

If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.