Proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. [1] Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

ID: T1090
Sub-techniques:  T1090.001, T1090.002, T1090.003, T1090.004
Platforms: Linux, Network, Windows, macOS
Contributors: Heather Linn; Jon Sheedy; Walker Johnson
Version: 3.1
Created: 31 May 2017
Last Modified: 30 August 2021

Procedure Examples

ID Name Description
G0096 APT41

APT41 used a tool called CLASSFON to covertly proxy network communications.[2]

S0456 Aria-body

Aria-body has the ability to use a reverse SOCKS proxy module.[3]

S0347 AuditCred

AuditCred can utilize proxy for communications.[4]

S0245 BADCALL

BADCALL functions as a proxy server between the victim and C2 server.[5]

S0268 Bisonal

Bisonal has supported use of a proxy server.[6]

G0108 Blue Mockingbird

Blue Mockingbird has used frp, ssf, and Venom to establish SOCKS proxy connections.[7]

S0348 Cardinal RAT

Cardinal RAT can act as a reverse proxy.[8]

G0052 CopyKittens

CopyKittens has used the AirVPN service for operational activity.[9]

S0384 Dridex

Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.[10][11]

G1006 Earth Lusca

Earth Lusca adopted Cloudflare as a proxy for compromised servers.[12]

G0117 Fox Kitten

Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.[13][14][15]

S1044 FunnyDream

FunnyDream can identify and use configured proxies in a compromised network for C2 communication.[16]

S0690 Green Lambert

Green Lambert can use proxies for C2 traffic.[17][18]

S0246 HARDRAIN

HARDRAIN uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.[19]

S0376 HOPLIGHT

HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.[20]

S0040 HTRAN

HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.[21][22]

S0283 jRAT

jRAT can serve as a SOCKS proxy server.[23]

S0487 Kessel

Kessel can use a proxy during exfiltration if set in the configuration.[24]

S0669 KOCTOPUS

KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.[25]

G1004 LAPSUS$

LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.[26]

S0108 netsh

netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.[27]

S0198 NETWIRE

NETWIRE can implement use of proxies to pivot traffic.[28]

S0508 Ngrok

Ngrok can be used to proxy connections to machines located behind NAT or firewalls.[29][30]

C0013 Operation Sharpshooter

For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.[31]

C0014 Operation Wocao

During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.[32]

S0435 PLEAD

PLEAD has the ability to proxy network communications.[33]

G1005 POLONIUM

POLONIUM has used the AirVPN service for operational activity.[9]

S0378 PoshC2

PoshC2 contains modules that allow for use of proxies in command and control.[34]

S0262 QuasarRAT

QuasarRAT can communicate over a reverse proxy using SOCKS5.[35][36]

S0629 RainyDay

RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.[37]

S0332 Remcos

Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.[38]

G0034 Sandworm Team

Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.[39]

S0461 SDBbot

SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.[40]

S0273 Socksbot

Socksbot can start SOCKS proxy threads.[41]

S0615 SombRAT

SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.[42]

S0436 TSCookie

TSCookie has the ability to proxy communications with command and control (C2) servers.[43]

G0010 Turla

Turla RPC backdoors have included local UPnP RPC proxies.[44]

S0263 TYPEFRAME

A TYPEFRAME variant can force the compromised system to function as a proxy server.[45]

S0386 Ursnif

Ursnif has used a peer-to-peer (P2P) network for C2.[46][47]

S0207 Vasport

Vasport is capable of tunneling though a proxy.[48]

S0670 WarzoneRAT

WarzoneRAT has the capability to act as a reverse proxy.[49]

G0124 Windigo

Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.[50]

S0117 XTunnel

XTunnel relays traffic between a C2 server and a victim.[51]

S0412 ZxShell

ZxShell can set up an HTTP or SOCKS proxy.[2][52]

Mitigations

ID Mitigation Description
M1037 Filter Network Traffic

Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques like Domain Fronting.

M1031 Network Intrusion Prevention

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools. [53]

M1020 SSL/TLS Inspection

If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.

Detection

ID Data Source Data Component Detects
DS0029 Network Traffic Network Connection Creation

Monitor for newly constructed network connections that are sent or received by untrusted hosts.

Network Traffic Content

Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)).

Network Traffic Flow

Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious.

References

  1. Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.
  2. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  3. CheckPoint. (2020, May 7). Naikon APT: Cyber Espionage Reloaded. Retrieved May 26, 2020.
  4. Trend Micro. (2018, November 20). Lazarus Continues Heists, Mounts Attacks on Financial Organizations in Latin America. Retrieved December 3, 2018.
  5. US-CERT. (2018, February 06). Malware Analysis Report (MAR) - 10135536-G. Retrieved June 7, 2018.
  6. Mercer, W., et al. (2020, March 5). Bisonal: 10 years of play. Retrieved January 26, 2022.
  7. Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.
  8. Grunzweig, J.. (2017, April 20). Cardinal RAT Active for Over Two Years. Retrieved December 8, 2018.
  9. Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.
  10. Dell SecureWorks Counter Threat Unit Threat Intelligence. (2015, October 13). Dridex (Bugat v5) Botnet Takeover Operation. Retrieved May 31, 2019.
  11. Check Point Research. (2021, January 4). Stopping Serial Killer: Catching the Next Strike. Retrieved September 7, 2021.
  12. Chen, J., et al. (2022). Delving Deep: An Analysis of Earth Lusca’s Operations. Retrieved July 1, 2022.
  13. CISA. (2020, September 15). Iran-Based Threat Actor Exploits VPN Vulnerabilities. Retrieved December 21, 2020.
  14. ClearSky. (2020, December 17). Pay2Key Ransomware – A New Campaign by Fox Kitten. Retrieved December 21, 2020.
  15. Check Point. (2020, November 6). Ransomware Alert: Pay2Key. Retrieved January 4, 2021.
  16. Vrabie, V. (2020, November). Dissecting a Chinese APT Targeting South Eastern Asian Government Institutions. Retrieved September 19, 2022.
  17. Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.
  18. Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved March 21, 2022.
  19. US-CERT. (2018, February 05). Malware Analysis Report (MAR) - 10135536-F. Retrieved June 11, 2018.
  20. US-CERT. (2019, April 10). MAR-10135536-8 – North Korean Trojan: HOPLIGHT. Retrieved April 19, 2019.
  21. Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 4, 2015.
  22. The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
  23. Kamluk, V. & Gostev, A. (2016, February). Adwind - A Cross-Platform RAT. Retrieved April 23, 2019.
  24. Dumont, R., M.Léveillé, M., Porcher, H. (2018, December 1). THE DARK SIDE OF THE FORSSHE A landscape of OpenSSH backdoors. Retrieved July 16, 2020.
  25. Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 24, 2021.
  26. MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.
  27. Kaspersky Lab's Global Research and Analysis Team. (2017, February 8). Fileless attacks against enterprise networks. Retrieved February 8, 2017.
  1. Lambert, T. (2020, January 29). Intro to Netwire. Retrieved January 7, 2021.
  2. Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020.
  3. Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.
  4. I. Ilascu. (2019, March 3). Op 'Sharpshooter' Connected to North Korea's Lazarus Group. Retrieved September 26, 2022.
  5. Dantzig, M. v., Schamper, E. (2019, December 19). Operation Wocao: Shining a light on one of China’s hidden hacking groups. Retrieved October 8, 2020.
  6. Tomonaga, S. (2018, June 8). PLEAD Downloader Used by BlackTech. Retrieved May 6, 2020.
  7. Nettitude. (2018, July 23). Python Server for PoshC2. Retrieved April 23, 2019.
  8. MaxXor. (n.d.). QuasarRAT. Retrieved July 10, 2018.
  9. Meltzer, M, et al. (2018, June 07). Patchwork APT Group Targets US Think Tanks. Retrieved July 16, 2018.
  10. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
  11. Klijnsma, Y. (2018, January 23). Espionage Campaign Leverages Spear Phishing, RATs Against Turkish Defense Contractors. Retrieved November 6, 2018.
  12. Cherepanov, A.. (2016, December 13). The rise of TeleBots: Analyzing disruptive KillDisk attacks. Retrieved June 10, 2020.
  13. Schwarz, D. et al. (2019, October 16). TA505 Distributes New SDBbot Remote Access Trojan with Get2 Downloader. Retrieved May 29, 2020.
  14. Lunghi, D., et al. (2017, December). Untangling the Patchwork Cyberespionage Group. Retrieved July 10, 2018.
  15. CISA. (2021, May 6). Analysis Report (AR21-126A) FiveHands Ransomware. Retrieved June 7, 2021.
  16. Tomonaga, S.. (2019, September 18). Malware Used by BlackTech after Network Intrusion. Retrieved May 6, 2020.
  17. Faou, M. and Dumont R.. (2019, May 29). A dive into Turla PowerShell usage. Retrieved June 14, 2019.
  18. US-CERT. (2018, June 14). MAR-10135536-12 – North Korean Trojan: TYPEFRAME. Retrieved July 13, 2018.
  19. NJCCIC. (2016, September 27). Ursnif. Retrieved June 4, 2019.
  20. Proofpoint Staff. (2016, August 25). Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality. Retrieved June 5, 2019.
  21. Zhou, R. (2012, May 15). Backdoor.Vasport. Retrieved February 22, 2018.
  22. Harakhavik, Y. (2020, February 3). Warzone: Behind the enemy lines. Retrieved December 17, 2021.
  23. Bilodeau, O., Bureau, M., Calvet, J., Dorais-Joncas, A., Léveillé, M., Vanheuverzwijn, B. (2014, March 18). Operation Windigo – the vivisection of a large Linux server‑side credential‑stealing malware campaign. Retrieved February 10, 2021.
  24. Alperovitch, D.. (2016, June 15). Bears in the Midst: Intrusion into the Democratic National Committee. Retrieved August 3, 2016.
  25. Allievi, A., et al. (2014, October 28). Threat Spotlight: Group 72, Opening the ZxShell. Retrieved September 24, 2019.
  26. Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.