T1090: Proxy

Description

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

Platforms

ESXiLinuxmacOSNetwork DevicesWindows

Sub-Techniques (4)

T1090.001

Domain Fronting

Mitigations (3)

Network Intrusion PreventionM1031

Network intrusion detection and prevention systems that use network signatures to identify traffic for specific adversary malware can be used to mitigate activity at the network level. Signatures are often for unique indicators within protocols and may be based on the specific C2 protocol used by a particular adversary or tool, and will likely be different across various malware families and versi

Filter Network TrafficM1037

Traffic to known anonymity networks and C2 infrastructure can be blocked through the use of network allow and block lists. It should be noted that this kind of blocking may be circumvented by other techniques like Domain Fronting.

SSL/TLS InspectionM1020

If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.

Threat Groups (19)

ID	Group	Context
G1017	Volt Typhoon	[Volt Typhoon](https://attack.mitre.org/groups/G1017) has used compromised devices and customized versions of open source tools such as [FRP](https:/...
G0096	APT41	[APT41](https://attack.mitre.org/groups/G0096) used a tool called CLASSFON to covertly proxy network communications.(Citation: FireEye APT41 Aug 2019)
G0069	MuddyWater	[MuddyWater](https://attack.mitre.org/groups/G0069) has used NordVPN to proxy phishing emails, making them appear to originate from France.(Citation: ...
G0047	Gamaredon Group	[Gamaredon Group](https://attack.mitre.org/groups/G0047) has used the Cloudflare Tunnel client to proxy C2 traffic.(Citation: ESET Gamaredon Sept2024)
G0034	Sandworm Team	[Sandworm Team](https://attack.mitre.org/groups/G0034)'s BCS-server tool can create an internal proxy server to redirect traffic from the adversary-co...
G1015	Scattered Spider	[Scattered Spider](https://attack.mitre.org/groups/G1015) has used proxy networks to hamper detection and has installed legitimate proxy tools on VMwa...
G1052	Contagious Interview	[Contagious Interview](https://attack.mitre.org/groups/G1052) has leveraged Astrill VPN for C2.(Citation: Recorded Future Contagious Inteview BeaverTa...
G0124	Windigo	[Windigo](https://attack.mitre.org/groups/G0124) has delivered a generic Windows proxy Win32/Glubteta.M. [Windigo](https://attack.mitre.org/groups/G01...
G1005	POLONIUM	[POLONIUM](https://attack.mitre.org/groups/G1005) has used the AirVPN service for operational activity.(Citation: Microsoft POLONIUM June 2022)
G1019	MoustachedBouncer	[MoustachedBouncer](https://attack.mitre.org/groups/G1019) has used a reverse proxy tool similar to the GitHub repository revsocks.(Citation: Moustach...
G0108	Blue Mockingbird	[Blue Mockingbird](https://attack.mitre.org/groups/G0108) has used [FRP](https://attack.mitre.org/software/S1144), ssf, and Venom to establish SOCKS p...
G0010	Turla	[Turla](https://attack.mitre.org/groups/G0010) RPC backdoors have included local UPnP RPC proxies.(Citation: ESET Turla PowerShell May 2019)
G1021	Cinnamon Tempest	[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) has used a customized version of the Iox port-forwarding and proxy tool.(Citation: Sygnia Em...
G1054	MirrorFace	[MirrorFace](https://attack.mitre.org/groups/G1054) has used the GO Simple Tunnel (GOST) proxy tool.(Citation: JPCERT MirrorFace JUL 2024)
G0117	Fox Kitten	[Fox Kitten](https://attack.mitre.org/groups/G0117) has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections ...
G1006	Earth Lusca	[Earth Lusca](https://attack.mitre.org/groups/G1006) adopted Cloudflare as a proxy for compromised servers.(Citation: TrendMicro EarthLusca 2022)
G1004	LAPSUS$	[LAPSUS$](https://attack.mitre.org/groups/G1004) has leverage NordVPN for its egress points when targeting intended victims.(Citation: MSTIC DEV-0537 ...
G0052	CopyKittens	[CopyKittens](https://attack.mitre.org/groups/G0052) has used the AirVPN service for operational activity.(Citation: Microsoft POLONIUM June 2022)
G0059	Magic Hound	[Magic Hound](https://attack.mitre.org/groups/G0059) has used Fast Reverse Proxy (FRP) for RDP traffic.(Citation: DFIR Phosphorus November 2021)

Associated Software (47)

ID	Name	Type	Context
S1187	reGeorg	Malware	[reGeorg](https://attack.mitre.org/software/S1187) can establish an HTTP or SOCKS proxy to tunnel data in and out of a network.(Citation: GitHub reGeo...
S0386	Ursnif	Malware	[Ursnif](https://attack.mitre.org/software/S0386) has used a peer-to-peer (P2P) network for C2.(Citation: NJCCIC Ursnif Sept 2016)(Citation: ProofPoin...
S1212	RansomHub	Malware	[RansomHub](https://attack.mitre.org/software/S1212) can use a proxy to connect to remote SFTP servers.(Citation: Group-IB RansomHub FEB 2025)
S1121	LITTLELAMB.WOOLTEA	Malware	[LITTLELAMB.WOOLTEA](https://attack.mitre.org/software/S1121) has the ability to function as a SOCKS proxy.(Citation: Mandiant Cutting Edge Part 3 Feb...
S1229	Havoc	Malware	[Havoc](https://attack.mitre.org/software/S1229) has the ability to route HTTP/S communications through designated proxies.(Citation: Havoc Framework ...
S0347	AuditCred	Malware	[AuditCred](https://attack.mitre.org/software/S0347) can utilize proxy for communications.(Citation: TrendMicro Lazarus Nov 2018)
S0629	RainyDay	Malware	[RainyDay](https://attack.mitre.org/software/S0629) can use proxy tools including boost_proxy_client for reverse proxy functionality.(Citation: Bitdef...
S0198	NETWIRE	Malware	[NETWIRE](https://attack.mitre.org/software/S0198) can implement use of proxies to pivot traffic.(Citation: Red Canary NETWIRE January 2020)
S0456	Aria-body	Malware	[Aria-body](https://attack.mitre.org/software/S0456) has the ability to use a reverse SOCKS proxy module.(Citation: CheckPoint Naikon May 2020)
S1081	BADHATCH	Malware	[BADHATCH](https://attack.mitre.org/software/S1081) can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. [BADHATCH](https://at...
S0615	SombRAT	Malware	[SombRAT](https://attack.mitre.org/software/S0615) has the ability to use an embedded SOCKS proxy in C2 communications.(Citation: CISA AR21-126A FIVEH...
S0376	HOPLIGHT	Malware	[HOPLIGHT](https://attack.mitre.org/software/S0376) has multiple proxy options that mask traffic between the malware and the remote operators.(Citatio...
S0690	Green Lambert	Malware	[Green Lambert](https://attack.mitre.org/software/S0690) can use proxies for C2 traffic.(Citation: Objective See Green Lambert for OSX Oct 2021)(Citat...
S0268	Bisonal	Malware	[Bisonal](https://attack.mitre.org/software/S0268) has supported use of a proxy server.(Citation: Talos Bisonal Mar 2020)
S1051	KEYPLUG	Malware	[KEYPLUG](https://attack.mitre.org/software/S1051) has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domain...
S0117	XTunnel	Malware	[XTunnel](https://attack.mitre.org/software/S0117) relays traffic between a C2 server and a victim.(Citation: Crowdstrike DNC June 2016)
S0436	TSCookie	Malware	[TSCookie](https://attack.mitre.org/software/S0436) has the ability to proxy communications with command and control (C2) servers.(Citation: JPCert Bl...
S0263	TYPEFRAME	Malware	A [TYPEFRAME](https://attack.mitre.org/software/S0263) variant can force the compromised system to function as a proxy server.(Citation: US-CERT TYPEF...
S1210	Sagerunex	Malware	[Sagerunex](https://attack.mitre.org/software/S1210) uses several proxy configuration settings to ensure connectivity.(Citation: Cisco LotusBlossom 20...
S0461	SDBbot	Malware	[SDBbot](https://attack.mitre.org/software/S0461) has the ability to use port forwarding to establish a proxy between a target host and C2.(Citation: ...

References

Frequently Asked Questions

What is T1090 (Proxy)?

T1090 is a MITRE ATT&CK technique named 'Proxy'. It belongs to the Command and Control tactic(s). Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to the...

How can T1090 be detected?

Detection of T1090 (Proxy) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.

What mitigations exist for T1090?

There are 3 documented mitigations for T1090. Key mitigations include: Network Intrusion Prevention, Filter Network Traffic, SSL/TLS Inspection.

Which threat groups use T1090?

Known threat groups using T1090 include: Volt Typhoon, APT41, MuddyWater, Gamaredon Group, Sandworm Team, Scattered Spider, Contagious Interview, Windigo.