T1090: Proxy
AI Answer
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. Adversaries use these types of (Source: MITRE ATT&CK T1090)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1090 |
| Name | Proxy |
| Tactic | Command and Control (command-and-control) |
| Platforms | ESXi, Linux, macOS, Network Devices, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, Proxy (T1090) is one of the highest-connectivity ATT&CK techniques: 76 MITRE STIX relationships reference this technique; 19 threat groups observed using it; 47 software families associated; 10 campaigns associated; 3 OpenTrojan content pages reference it. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1090). Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic. Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.
Detection
DET0445 Detection of Proxy Infrastructure Setup and Traffic Bridging AN1229 Suspicious process spawning (e.g., rundll32 , svchost , powershell , or netsh ) followed by network connection creation to internal hosts or uncommon external endpoints on high or non-standard ports. AN1230 User-space tools (e.g., socat , ncat , iptables , ssh ) used in non-standard ways to establish reverse shells, port-forwarding, or inter-host connections. Often chained with uncommon outbound destinations or SSH tunnels. AN1231 AppleScript, LaunchAgents, or remote login services ( ssh , networksetup ) establishing proxy tunnels or dynamic port forwards to external IPs or alternate local hosts. AN1232 Direct use of nc , socat , or reverse tunnel scripts initiated by abnormal user contexts or unauthorized VIBs initiating connections from hypervisor to external systems. AN1233 Dynamic or static port forwarding rules added to route traffic through an internal host, or configuration changes to proxy firewall rules not aligned with baselined policy.
Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1090).
Mitigation
Use intrusion detection signatures to block traffic at network boundaries.
Mitigation guidance is from the MITRE ATT&CK course-of-action associated with this technique.
Related Software
- reGeorg
- Ursnif
- RansomHub
- LITTLELAMB.WOOLTEA
- Havoc
- AuditCred
- RainyDay
- NETWIRE
- Aria-body
- BADHATCH
- SombRAT
- HOPLIGHT
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- Volt Typhoon
- APT41
- MuddyWater
- Gamaredon Group
- Sandworm Team
- Scattered Spider
- Contagious Interview
- Windigo
- POLONIUM
- MoustachedBouncer
- Blue Mockingbird
- Turla
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- SharePoint ToolShell Exploitation
- RedDelta Modified PlugX Infection Chain Operations
- RedPenguin
- Operation Sharpshooter
- Operation MidnightEclipse
- Salesforce Data Exfiltration
- 2025 Poland Wiper Attacks
- Operation Wocao
- C0017
- C0027
Campaign associations are from MITRE ATT&CK STIX relationships.
Related Content
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1090 Proxy. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1090 Proxy?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.