Automation · API / MCP 中文

Technique note · T1090

Proxy

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

ATT&CK T1090 platforms — Status Active Version 20.1

Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap.1 Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.

  1. Trend Micro APT Attack Tools

Groups using this technique

GroupNameCountry
grp_g1005POLONIUM—
grp_g1054MirrorFace—
grp_g0117Fox Kitten—
grp_g0108Blue Mockingbird—
grp_g1045Salt Typhoon—
grp_g0052CopyKittensIran
grp_g1021Cinnamon TempestChina
grp_g1015Scattered Spider—
grp_g0124Windigo—
grp_g1019MoustachedBouncer—
grp_g1004LAPSUS$—
grp_g1052Contagious Interview—
grp_g0069MuddyWater—
grp_g1017Volt Typhoon—
grp_g0010TurlaRussia
grp_g0047Gamaredon GroupRussia
grp_g0059Magic HoundIran
grp_g0096APT41China
grp_g1006Earth LuscaChina
grp_g0034Sandworm TeamRussia

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.