Proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. [1] Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

ID: T1090
Sub-techniques:  T1090.001, T1090.002, T1090.003, T1090.004
Tactic: Command And Control
Platforms: Linux, Windows, macOS
Data Sources: Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Contributors: Brian Prange; Heather Linn; Walker Johnson
Version: 3.0
Created: 31 May 2017
Last Modified: 20 June 2020

Procedure Examples

Name Description
APT41

APT41 used a tool called CLASSFON to covertly proxy network communications.[23]

Aria-body

Aria-body has the ability to use a reverse SOCKS proxy module.[27]

AuditCred

AuditCred can utilize proxy for communications.[16]

BADCALL

BADCALL functions as a proxy server between the victim and C2 server.[10]

Blue Mockingbird

Blue Mockingbird has used frp, ssf, and Venom to establish SOCKS proxy connections.[31]

Cardinal RAT

Cardinal RAT can act as a reverse proxy.[13]

Dridex

Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.[20]

HARDRAIN

HARDRAIN uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.[11]

HOPLIGHT

HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.[18]

HTRAN

HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.[3][4]

jRAT

jRAT can serve as a SOCKS proxy server.[19]

netsh

netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.[8]

PLEAD

PLEAD has the ability to proxy network communications.[25]

PoshC2

PoshC2 contains modules that allow for use of proxies in command and control.[9]

QuasarRAT

QuasarRAT can communicate over a reverse proxy using SOCKS5.[5][6]

Remcos

Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.[7]

Sandworm Team

Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.[32]

SDBot

SDBot has the ability to use port forwarding to establish a proxy between a target host and C2.[28]

Socksbot

Socksbot can start SOCKS proxy threads.[15]

TSCookie

TSCookie has the ability to proxy communications with command and control (C2) servers.[26]

Turla

Turla RPC backdoors have included local UPnP RPC proxies.[29]

TYPEFRAME

A TYPEFRAME variant can force the compromised system to function as a proxy server.[12]

Ursnif

Ursnif has used a peer-to-peer (P2P) network for C2.[21][22]

Vasport

Vasport is capable of tunneling though a proxy.[17]

Wizard Spider

Wizard Spider has used a module named NewBCtestnDll64 as a reverse SOCKS proxy.[30]

XTunnel

XTunnel relays traffic between a C2 server and a victim.[14]

ZxShell

ZxShell can set up an HTTP or SOCKS proxy.[23][24]

Mitigations

Mitigation Description
Filter Network Traffic

Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques like Domain Fronting.

Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. [2]

SSL/TLS Inspection

If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.

Detection

Analyze network data for uncommon data flows (e.g., a client sending significantly more data than it receives from a server or between clients that should not or often do not communicate with one another). Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. Analyze packet contents to detect communications that do not follow the expected protocol behavior for the port that is being used. [2]

Consider monitoring for traffic to known anonymity networks (such as Tor).

References

  1. Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.
  2. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
  3. Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 4, 2015.
  4. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
  5. MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018.
  6. Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.
  7. Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.
  8. Kaspersky Lab's Global Research and Analysis Team. (2017, February 8). Fileless attacks against enterprise networks. Retrieved February 8, 2017.
  9. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  10. US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018.
  11. US-CERT. (2018, February 05). Malware Analysis Report (MAR) - 10135536-F. Retrieved June 11, 2018.
  12. US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.
  13. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.
  14. Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.
  15. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  16. Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018.
  1. Zhou, R. (2012, May 15). Backdoor.Vasport. Retrieved February 22, 2018.
  2. US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.
  3. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.
  4. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019.
  5. NJCCIC. (2016, September 27). Ursnif. Retrieved June 4, 2019.
  6. Proofpoint Staff. (2016, August 25). Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality. Retrieved June 5, 2019.
  7. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  8. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.
  9. Tomonaga, S.. (2018, June 8). PLEAD Downloader Used by BlackTech. Retrieved May 6, 2020.
  10. Tomonaga, S.. (2019, September 18). Malware Used by BlackTech after Network Intrusion. Retrieved May 6, 2020.
  11. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.
  12. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
  13. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  14. John, E. and Carvey, H. (2019, May 30). Unraveling the Spiderweb: Timelining ATT&CK Artifacts Used by GRIM SPIDER. Retrieved May 12, 2020.
  15. Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.
  16. Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020.