Description
Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use internal proxies to manage command and control communications inside a compromised environment, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between infected systems to avoid suspicion. Internal proxy connections may use common peer-to-peer (p2p) networking protocols, such as SMB, to better blend in with the environment.
By using a compromised internal system as a proxy, adversaries may conceal the true destination of C2 traffic while reducing the need for numerous connections to external systems.
Platforms
Mitigations (1)
Network Intrusion PreventionM1031
Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versi
Threat Groups (9)
| ID | Group | Context |
|---|---|---|
| G1047 | Velvet Ant | [Velvet Ant](https://attack.mitre.org/groups/G1047) has tunneled traffic from victims through an internal, compromised host to proxy communications to... |
| G1016 | FIN13 | [FIN13](https://attack.mitre.org/groups/G1016) has utilized a proxy tool to communicate between compromised assets.(Citation: Sygnia Elephant Beetle J... |
| G0126 | Higaisa | [Higaisa](https://attack.mitre.org/groups/G0126) discovered system proxy settings and used them if available.(Citation: Zscaler Higaisa 2020) |
| G0030 | Lotus Blossom | [Lotus Blossom](https://attack.mitre.org/groups/G0030) has used publicly available tools such as the Venom proxy tool to proxy traffic out of victim e... |
| G0041 | Strider | [Strider](https://attack.mitre.org/groups/G0041) has used local servers with both local network and Internet access to act as internal proxy nodes to ... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has used the built-in [netsh](https://attack.mitre.org/software/S0108) `port proxy` command to c... |
| G0010 | Turla | [Turla](https://attack.mitre.org/groups/G0010) has compromised internal network systems to act as a proxy to forward traffic to C2.(Citation: Talos Ti... |
| G0032 | Lazarus Group | [Lazarus Group](https://attack.mitre.org/groups/G0032) has used a compromised router to serve as a proxy between a victim network's corporate and rest... |
| G0087 | APT39 | [APT39](https://attack.mitre.org/groups/G0087) used custom tools to create SOCK5 and custom protocol proxies between infected hosts.(Citation: FireEye... |
Associated Software (23)
| ID | Name | Type | Context |
|---|---|---|---|
| S0556 | Pay2Key | Malware | [Pay2Key](https://attack.mitre.org/software/S0556) has designated machines in the compromised network to serve as reverse proxy pivot points to channe... |
| S0038 | Duqu | Malware | [Duqu](https://attack.mitre.org/software/S0038) can be configured to have commands relayed over a peer-to-peer network of infected hosts if some of th... |
| S0023 | CHOPSTICK | Malware | [CHOPSTICK](https://attack.mitre.org/software/S0023) used a proxy server between victims and the C2 server.(Citation: ESET Sednit Part 2) |
| S9010 | GlassWorm | Malware | [GlassWorm](https://attack.mitre.org/software/S9010) has leveraged peer-to-peer software to facilitate communications within the victim network to inc... |
| S9023 | HiddenFace | Malware | [HiddenFace](https://attack.mitre.org/software/S9023) can act as an internal HTTP proxy within the targeted environment.(Citation: Trend Micro Earth K... |
| S0502 | Drovorub | Malware | [Drovorub](https://attack.mitre.org/software/S0502) can use a port forwarding rule on its agent module to relay network traffic through the client mod... |
| S0154 | Cobalt Strike | Malware | [Cobalt Strike](https://attack.mitre.org/software/S0154) can be configured to have commands relayed over a peer-to-peer network of infected hosts. Thi... |
| S1060 | Mafalda | Malware | [Mafalda](https://attack.mitre.org/software/S1060) can create a named pipe to listen for and send data to a named pipe-based C2 server.(Citation: Sent... |
| S0699 | Mythic | Tool | [Mythic](https://attack.mitre.org/software/S0699) can leverage a peer-to-peer C2 profile between agents.(Citation: Mythc Documentation) |
| S0141 | Winnti for Windows | Malware | The [Winnti for Windows](https://attack.mitre.org/software/S0141) HTTP/S C2 mode can make use of a local proxy.(Citation: Novetta Winnti April 2015) |
| S0051 | MiniDuke | Malware | [MiniDuke](https://attack.mitre.org/software/S0051) can can use a named pipe to forward communications from one compromised machine with internet acce... |
| S0512 | FatDuke | Malware | [FatDuke](https://attack.mitre.org/software/S0512) can used pipes to connect machines with restricted internet access to remote machines via other inf... |
| S0265 | Kazuar | Malware | [Kazuar](https://attack.mitre.org/software/S0265) has used internal nodes on the compromised network for C2 communications.(Citation: Accenture HyperS... |
| S0031 | BACKSPACE | Malware | The "ZJ" variant of [BACKSPACE](https://attack.mitre.org/software/S0031) allows "ZJ link" infections with Internet access to relay traffic from "ZJ li... |
| S0633 | Sliver | Tool | [Sliver](https://attack.mitre.org/software/S0633) has a built-in SOCKS5 proxying capability allowing for [Sliver](https://attack.mitre.org/software/S0... |
| S1100 | Ninja | Malware | [Ninja](https://attack.mitre.org/software/S1100) can proxy C2 communications including to and from internal agents without internet connectivity.(Cita... |
| S0260 | InvisiMole | Malware | [InvisiMole](https://attack.mitre.org/software/S0260) can function as a proxy to create a server that relays communication between the client and C&C ... |
| S1059 | metaMain | Malware | [metaMain](https://attack.mitre.org/software/S1059) can create a named pipe to listen for and send data to a named pipe-based C2 server.(Citation: Sen... |
| S1198 | Gomir | Malware | [Gomir](https://attack.mitre.org/software/S1198) can start a reverse proxy to initiate connections to arbitrary endpoints in victim networks.(Citation... |
| S0009 | Hikit | Malware | [Hikit](https://attack.mitre.org/software/S0009) supports peer connections.(Citation: Novetta-Axiom) |
References
- Gardiner, J., Cova, M., Nagaraja, S. (2014, February). Command & Control Understanding, Denying and Detecting. Retrieved April 20, 2016.
- Wilhoit, K. (2013, March 4). In-Depth Look: APT Attack Tools of the Trade. Retrieved December 2, 2015.
Frequently Asked Questions
What is T1090.001 (Internal Proxy)?
T1090.001 is a MITRE ATT&CK technique named 'Internal Proxy'. It belongs to the Command and Control tactic(s). Adversaries may use an internal proxy to direct command and control traffic between two or more systems in a compromised environment. Many tools exist that enable traffic redirection through proxies o...
How can T1090.001 be detected?
Detection of T1090.001 (Internal Proxy) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1090.001?
There are 1 documented mitigations for T1090.001. Key mitigations include: Network Intrusion Prevention.
Which threat groups use T1090.001?
Known threat groups using T1090.001 include: Velvet Ant, FIN13, Higaisa, Lotus Blossom, Strider, Volt Typhoon, Turla, Lazarus Group.