MITRE ATT&CK Technique
T1090Proxy
- First Reported
- Oct 14, 2025
- Latest Reported
- Sep 26, 2026
Official Description
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.
Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.
- Tactics
- Command And Control
- Platforms
- ESXi, Linux, macOS, Network Devices, Windows
- MITRE Version
- 3.2
- Last Modified
- May 12, 2026
Sub-techniques (4)
Reported Context (4)
- Neo-reGeorg routed SOCKS5 proxy traffic through HTTP or HTTPS connections to the compromised web tier. ShinyHunters Resume Mass Exploitation of Oracle PeopleSoft Vulnerability CVE-2026-35273
- Kothamine used tailcat to forward connections from a local TCP port to port 4444 on an operator node. Kothamine RAT Uses Tailscale’s Tailcat for Encrypted Command-and-Control
- A Go secondary payload connected to its C2 over WebSocket Secure and relayed traffic between requested destinations through multiplexed streams. ClearFake WebDAV Chains Deliver Amatera, ZigCryptoStealer and Unauthorized NetSupport
- Kaiji includes SOCKS5 and HTTP proxies for relaying traffic through compromised systems. Kaiji Malware Analysis Details Linux Persistence and Evasion Techniques
CVE (2)
Malware (9)
Threat Actors (3)
MITRE ATT&CK (35)
Vendors (7)
Products (13)
Tools (8)
Industries (1)
Countries (7)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.