Description
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.
By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.
Platforms
Mitigations (1)
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versi
Threat Groups (9)
| ID | Group | Context |
|---|---|---|
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used the built-in [netsh](https://attack.mitre.org/software/S0108) `port proxy` command to c... |
| G0041 | Strider | [Strider](https://attack.mitre.org/groups/G0041) has used local servers with both local network and Internet access to act as internal proxy nodes to ... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) used custom tools to create SOCK5 and custom protocol proxies between infected hosts.(Citation: FireEye... |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126) discovered system proxy settings and used them if available.(Citation: Zscaler Higaisa 2020) |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) has compromised internal network systems to act as a proxy to forward traffic to C2.(Citation: Talos Ti... |
| G0030 | Lotus Blossom | [Lotus Blossom](https://attack.mitre.org/groups/G0030) has used publicly available tools such as the Venom proxy tool to proxy traffic out of victim e... |
| G0032 | Lazarus Group | [Lazarus Group](https://attack.mitre.org/groups/G0032) has used a compromised router to serve as a proxy between a victim network's corporate and rest... |
| G1047 | Velvet Ant | [Velvet Ant](https://attack.mitre.org/groups/G1047) has tunneled traffic from victims through an internal, compromised host to proxy communications to... |
| G1016 | FIN13 | [FIN13](https://attack.mitre.org/groups/G1016) has utilized a proxy tool to communicate between compromised assets.(Citation: Sygnia Elephant Beetle J... |
Associated Software (23)
| ID | Name | Type | Context |
|---|---|---|---|
| S1100 | Ninja | Malware | [Ninja](https://attack.mitre.org/software/S1100) can proxy C2 communications including to and from internal agents without internet connectivity.(Cita... |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has leveraged SOCKS Proxy to pivot into victim networks in attempts to resemble legitimate admin... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) installs an RPC server for P2P communications.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chie... |
| S1198 | Gomir | Malware | [Gomir](https://attack.mitre.org/software/S1198) can start a reverse proxy to initiate connections to arbitrary endpoints in victim networks.(Citation... |
| S1060 | Mafalda | Malware | [Mafalda](https://attack.mitre.org/software/S1060) can create a named pipe to listen for and send data to a named pipe-based C2 server.(Citation: Sent... |
| S0260 | InvisiMole | Malware | [InvisiMole](https://attack.mitre.org/software/S0260) can function as a proxy to create a server that relays communication between the client and C&C ... |
| S0265 | Kazuar | Malware | [Kazuar](https://attack.mitre.org/software/S0265) has used internal nodes on the compromised network for C2 communications.(Citation: Accenture HyperS... |
| S0512 | FatDuke | Malware | [FatDuke](https://attack.mitre.org/software/S0512) can used pipes to connect machines with restricted internet access to remote machines via other inf... |
| S0051 | MiniDuke | Malware | [MiniDuke](https://attack.mitre.org/software/S0051) can can use a named pipe to forward communications from one compromised machine with internet acce... |
| S0556 | Pay2Key | Malware | [Pay2Key](https://attack.mitre.org/software/S0556) has designated machines in the compromised network to serve as reverse proxy pivot points to channe... |
| S9010 | GlassWorm | Malware | [GlassWorm](https://attack.mitre.org/software/S9010) has leveraged peer-to-peer software to facilitate communications within the victim network to inc... |
| S0009 | Hikit | Malware | [Hikit](https://attack.mitre.org/software/S0009) supports peer connections.(Citation: Novetta-Axiom) |
| S0502 | Drovorub | Malware | [Drovorub](https://attack.mitre.org/software/S0502) can use a port forwarding rule on its agent module to relay network traffic through the client mod... |
| S9023 | HiddenFace | Malware | [HiddenFace](https://attack.mitre.org/software/S9023) can act as an internal HTTP proxy within the targeted environment.(Citation: Trend Micro Earth K... |
| S0154 | Cobalt Strike | Malware | [Cobalt Strike](https://attack.mitre.org/software/S0154) can be configured to have commands relayed over a peer-to-peer network of infected hosts. Thi... |
| S0023 | CHOPSTICK | Malware | [CHOPSTICK](https://attack.mitre.org/software/S0023) used a proxy server between victims and the C2 server.(Citation: ESET Sednit Part 2) |
| S0141 | Winnti for Windows | Malware | The [Winnti for Windows](https://attack.mitre.org/software/S0141) HTTP/S C2 mode can make use of a local proxy.(Citation: Novetta Winnti April 2015) |
| S1059 | metaMain | Malware | [metaMain](https://attack.mitre.org/software/S1059) can create a named pipe to listen for and send data to a named pipe-based C2 server.(Citation: Sen... |
| S1227 | StarProxy | Malware | [StarProxy](https://attack.mitre.org/software/S1227) has proxied traffic between infected devices and their C2 servers.(Citation: Zscaler) |
| S0031 | BACKSPACE | Malware | The "ZJ" variant of [BACKSPACE](https://attack.mitre.org/software/S0031) allows "ZJ link" infections with Internet access to relay traffic from "ZJ li... |
References
- Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
- Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.
Frequently Asked Questions
What is T1090.001 (Internal Proxy)?
T1090.001 is a MITRE ATT&CK technique named 'Internal Proxy'. It belongs to the Command and Control tactic(s). Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies o...
How can T1090.001 be detected?
Detection of T1090.001 (Internal Proxy) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1090.001?
There are 1 documented mitigations for T1090.001. Key mitigations include: Network Intrusion Prevention.
Which threat groups use T1090.001?
Known threat groups using T1090.001 include: Volt Typhoon, Strider, APT39, Higaisa, Turla, Lotus Blossom, Lazarus Group, Velvet Ant.