ID | Name |
---|---|
T1090.001 | Internal Proxy |
T1090.002 | External Proxy |
T1090.003 | Multi-hop Proxy |
T1090.004 | Domain Fronting |
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. [1] Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.
By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.
ID | Name | Description |
---|---|---|
G0087 | APT39 |
APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.[2][3] |
S0031 | BACKSPACE |
The "ZJ" variant of BACKSPACE allows "ZJ link" infections with Internet access to relay traffic from "ZJ listen" to a command server.[4] |
S0023 | CHOPSTICK |
CHOPSTICK used a proxy server between victims and the C2 server.[5] |
S0154 | Cobalt Strike |
Cobalt Strike can be configured to have commands relayed over a peer-to-peer network of infected hosts. This can be used to limit the number of egress points, or provide access to a host without direct internet access.[6][7] |
S0502 | Drovorub |
Drovorub can use a port forwarding rule on its agent module to relay network traffic through the client module to a remote host on the same network.[8] |
S0038 | Duqu |
Duqu can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of the hosts do not have Internet access.[9] |
S0512 | FatDuke |
FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts.[10] |
G1016 | FIN13 |
FIN13 has utilized a proxy tool to communicate between compromised assets.[11] |
G0126 | Higaisa |
Higaisa discovered system proxy settings and used them if available.[12] |
S0009 | Hikit | |
S0260 | InvisiMole |
InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server, or between two clients.[14] |
S0265 | Kazuar |
Kazuar has used internal nodes on the compromised network for C2 communications.[15] |
G0032 | Lazarus Group |
Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.[16] |
S1060 | Mafalda |
Mafalda can create a named pipe to listen for and send data to a named pipe-based C2 server.[17] |
S1059 | metaMain |
metaMain can create a named pipe to listen for and send data to a named pipe-based C2 server.[17] |
S0051 | MiniDuke |
MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines.[10] |
S0699 | Mythic |
Mythic can leverage a peer-to-peer C2 profile between agents.[18] |
S1100 | Ninja |
Ninja can proxy C2 communications including to and from internal agents without internet connectivity.[19][20] |
C0014 | Operation Wocao |
During Operation Wocao, threat actors proxied traffic through multiple infected systems.[21] |
S0556 | Pay2Key |
Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2.[22][23] |
C0024 | SolarWinds Compromise |
During the SolarWinds Compromise, APT29 used SSH port forwarding capabilities on public-facing systems, and configured at least one instance of Cobalt Strike to use a network pipe over SMB.[24][25] |
G0041 | Strider |
Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.[26] |
S0603 | Stuxnet | |
G0010 | Turla |
Turla has compromised internal network systems to act as a proxy to forward traffic to C2.[28] |
G1017 | Volt Typhoon |
Volt Typhoon has used the built-in netsh |
S0141 | Winnti for Windows |
The Winnti for Windows HTTP/S C2 mode can make use of a local proxy.[30] |
ID | Mitigation | Description |
---|---|---|
M1031 | Network Intrusion Prevention |
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versions. Adversaries will likely change tool C2 signatures over time or construct protocols in such a way as to avoid detection by common defensive tools.[31] |
ID | Data Source | Data Component | Detects |
---|---|---|---|
DS0029 | Network Traffic | Network Connection Creation |
Monitor for newly constructed network connections that are sent or received by untrusted hosts. |
Network Traffic Content |
Monitor and analyze traffic patterns and packet inspection associated to protocol(s) that do not follow the expected protocol standards and traffic flows (e.g extraneous packets that do not belong to established flows, gratuitous or anomalous traffic patterns, anomalous syntax, or structure). Consider correlation with process monitoring and command line to detect anomalous processes execution and command line arguments associated to traffic patterns (e.g. monitor anomalies in use of files that do not normally initiate connections for respective protocol(s)). |
||
Network Traffic Flow |
Monitor network data for uncommon data flows. Processes utilizing the network that do not normally have network communication or have never been seen before are suspicious. |