How to Detect IOX, FRP, and Rakshasa Proxy Infrastructure
Summary
The article demonstrates how defenders can identify likely IOX, FRP, and Rakshasa deployments using TLS certificate fingerprints, HTTP responses, and exposed files and configurations.
Key points
- IOX deployments can be found through filename searches and by reviewing adjacent files and tooling in exposed directories.
- Rakshasa's default TLS certificate and JA4X fingerprint can help identify likely servers; HTTP proxy responses and TLS behavior provide additional signals.
- FRP servers may return a recognizable default 404 response, while exposed configuration files can contain predictable paths and default test tokens.
- The article recommends corroborating infrastructure indicators with additional evidence before using them in detection or response workflows.
- These proxies can enable traffic tunneling, remote access, lateral movement, and persistent communication in intrusions.
Article Details
- Defense Focus
- Identify likely attacker-deployed IOX, FRP, and Rakshasa proxy infrastructure through TLS, HTTP, and file/configuration artifacts.
- Detection Methods
- Search exposed directories for IOX binaries using the filename query /iox; pivot through directory contents and inspect adjacent artifacts to assess malicious staging.
- Fingerprint Rakshasa using its default embedded certificate fields together with JA4X fingerprint 4f24da86fad6_4f24da86fad6_bb943afcc34f, certificate subject fields, and recent certificate observations.
- Correlate Rakshasa certificate matches with TLS behavior: the server presents the certificate and resets the connection, and uses ECDHE-RSA-AES128-GCM-SHA256.
- Probe suspected Rakshasa HTTP proxy services for a 407 Proxy Authentication Required response with the Basic realm Access to internal site.
- Identify FRP servers by matching the default 404 response body hash, then narrow results by searching exposed configuration files for /frpc.log and token = 12345678.
- Corroborate matches with surrounding directory contents, related tools, and other observed behaviors before using them for detection or response.
- Data Sources
- TLS certificates, subject fields, JA4X fingerprints, handshake behavior, and cipher suites
- HTTP response status, headers, and body hashes
- Open directories, filenames, directory contents, and exposed FRP configuration files
- Hunt.io AttackCapture and HuntSQL results
- Rule Types
- HuntSQL certificate and JA4X query
- HuntSQL HTTP response body-hash query
- AttackCapture filename search
- AttackCapture Code Search query
- Platforms
- Hunt.io AttackCapture
- HuntSQL
- Defensive Actions
- Monitor exposed directories for proxy binaries and configuration artifacts, and inspect adjacent files for staging context.
- Use the Rakshasa certificate, JA4X, TLS, and HTTP traits to identify candidate servers; corroborate candidates before detection or response.
- Narrow broad FRP HTTP body-hash matches with configuration-file searches and validate the resulting directories.
- Treat proxy-tool observations as infrastructure signals and correlate them with credential harvesters, remote shells, or other operator tooling.
MITRE ATT&CK
T1090 · ProxyThe article describes IOX, FRP, and Rakshasa being used as proxies or tunnels to relay traffic through intermediary or attacker-controlled infrastructure.T1090.001 · Internal ProxyThe article describes proxy tools redirecting traffic through attacker-controlled paths and FRP exposing services through a client-server tunneling setup.T1572 · Protocol TunnelingRakshasa and FRP support tunneling network traffic between internal and external systems; the article describes their use to establish persistent tunnels.
Threat Actors
Bronze StarlightThe article gives Bronze Starlight as an alternate name for Emperor Dragonfly.Earth BakuTrend Micro reported use of Rakshasa by the group to maintain access and move laterally within compromised internal networks.Emperor DragonflySygnia reported that the group deployed a modified version of IOX alongside Cobalt Strike and a keylogger in 2022.PhosphorusCybereason reported that the Iranian APT group deployed FRP after exploiting vulnerable Microsoft Exchange servers.Slow TempestSecuronix documented IOX use by the group on compromised Windows hosts to maintain outbound connectivity and exfiltrate sensitive data.UAT-5918Cisco Talos documented the group using FRP to establish persistent tunnels from compromised endpoints to attacker-controlled infrastructure.
Malware
Vendors
Cisco Talosdeployed the proxy tool after exploiting vulnerable Microsoft Exchange servers. More recently, Cisco Talos documented the use of FRP by UAT-5918 to establish persistent tunnels from compromised endpoints toCybereasonFRP has been observed in multiple targeted operations. Cybereason reported that the Iranian APT group Phosphorus deployed the proxy tool after exploiting vulnerable Microsoft Exchange servers. More recently, Cisco TalosSecuronixStarlight) deployed a modified version of IOX alongside Cobalt Strike and a keylogger. Separately, Securonix documented IOX being used by Slow Tempest on compromised Windows hosts to maintain outbound connectivitySygniaThe tool has been linked to multiple real-world intrusions. In 2022, Sygnia reported that Emperor Dragonfly (Bronze Starlight) deployed a modified version of IOX alongside Cobalt Strike and a keylogger. Separately,Trend MicroTrend Micro has reported on the use of Rakshasa by Earth Baku, an APT group that leveraged the tool to maintain access and move laterally within compromised internal networks.
Products
AttackCaptureFigure 1: IOX GitHub repository README.Hunting IOX Deployments in AttackCaptureCobalt Strikereported that Emperor Dragonfly (Bronze Starlight) deployed a modified version of IOX alongside Cobalt Strike and a keylogger. Separately, Securonix documented IOX being used by Slow Tempest on compromisedFRPorigin infrastructure, and blend in with legitimate network activity. Open-source proxies like IOX, FRP, and Rakshasa are frequently used for these purposes, offering lightweight tunneling and remote accessHunt.ioThis post demonstrates how to identify these deployments using Hunt.io by leveraging observable traits across TLS, HTTP, and file-based artifacts, enabling defenders to surface proxy infrastructure before it'sHuntSQLPivoting on Default Certificates in HuntSQLIOXobscure origin infrastructure, and blend in with legitimate network activity. Open-source proxies like IOX, FRP, and Rakshasa are frequently used for these purposes, offering lightweight tunneling and remote accessMicrosoft Exchangereported that the Iranian APT group Phosphorus deployed the proxy tool after exploiting vulnerable Microsoft Exchange servers. More recently, Cisco Talos documented the use of FRP by UAT-5918 to establish persistentRakshasainfrastructure, and blend in with legitimate network activity. Open-source proxies like IOX, FRP, and Rakshasa are frequently used for these purposes, offering lightweight tunneling and remote access capabilities
Tools
HavocThese included shell scripts, Linux ELF binaries, and known malware families such as Gh0stRAT, PowerCat, Havoc, and Viper. The presence of IOX in these environments suggests it was being staged for lateral movement,PowerCatactivity. These included shell scripts, Linux ELF binaries, and known malware families such as Gh0stRAT, PowerCat, Havoc, and Viper. The presence of IOX in these environments suggests it was being staged for lateralVipershell scripts, Linux ELF binaries, and known malware families such as Gh0stRAT, PowerCat, Havoc, and Viper. The presence of IOX in these environments suggests it was being staged for lateral movement, outbound