[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1090":3},{"item":4,"lessons":18,"controls":68,"related":98},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1090","T1090","Proxy",19,"MITRE","**What attackers do.** Attackers route traffic through intermediary systems, such as compromised hosts, rented servers, residential proxy networks or anonymising services, to hide where it really comes from or to reach systems that are not directly reachable. This serves the Command and Control tactic.\n\n**How to defend.** Restrict outbound connections to known proxies and block anonymising networks where business allows. Inside the network, monitor for hosts acting as relays between segments. On the identity side, use reputation data on residential proxies and anonymisers when evaluating logins.\n\n**Signs to look for.** Look for internal hosts listening on unusual ports and forwarding traffic, connections to known proxy or anonymisation infrastructure, and logins whose source changes rapidly between unrelated networks. A common gap is that residential proxies make malicious logins appear to come from ordinary home connections.","Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.\n\nAdversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1090\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40,44,48,52,56,60,64],{"slug":21,"title":22,"published_at":23},"avisloader-exploits-clickfix-social-engineering-and-tox-p2p-for-resilient-c2","AvisLoader Exploits ClickFix Social Engineering and Tox P2P for Resilient C2","2026-09-24T10:20:39.211+00:00",{"slug":25,"title":26,"published_at":27},"residential-proxies-and-vpns-are-defeating-edge-security-controls","Residential Proxies and VPNs Are Defeating Edge Security Controls","2026-09-01T16:21:32.91+00:00",{"slug":29,"title":30,"published_at":31},"chinese-state-hackers-exploited-iot-botnets-and-proxy-tools-to-breach-us-agencies","Chinese State Hackers Exploited IoT Botnets and Proxy Tools to Breach US Agencies","2026-08-26T20:21:48.416+00:00",{"slug":33,"title":34,"published_at":35},"fbi-dismantles-chinese-espionage-proxy-network-targeting-us-critical-infrastructure","FBI Dismantles Chinese Espionage Proxy Network Targeting U.S. Critical Infrastructure","2026-08-26T16:21:55.36+00:00",{"slug":37,"title":38,"published_at":39},"mirai-based-botnet-hijacks-routers-via-known-vulnerabilities","Mirai-Based Botnet Hijacks Routers via Known Vulnerabilities","2026-08-15T16:20:22.954+00:00",{"slug":41,"title":42,"published_at":43},"chinese-speaking-apt-deploys-octlurk-silklurk-backdoors-against-central-asian-governments","Chinese-Speaking APT Deploys OctLurk & SilkLurk Backdoors Against Central Asian Governments","2026-07-31T20:20:26.595+00:00",{"slug":45,"title":46,"published_at":47},"memory-resident-backdoors-octlurk-silklurk-target-central-asian-governments","Memory-Resident Backdoors OctLurk & SilkLurk Target Central Asian Governments","2026-07-30T12:20:40.699+00:00",{"slug":49,"title":50,"published_at":51},"iranian-apt-turns-victim-systems-into-covert-c2-relay-nodes","Iranian APT Turns Victim Systems Into Covert C2 Relay Nodes","2026-07-28T14:22:03.313+00:00",{"slug":53,"title":54,"published_at":55},"mirage-kitten-apt-deploys-covert-backdoor-via-spear-phishing-lures","Mirage Kitten APT Deploys Covert Backdoor via Spear-Phishing Lures","2026-07-28T10:21:25.243+00:00",{"slug":57,"title":58,"published_at":59},"chaos-ransomware-hides-c2-traffic-in-legitimate-browser-sessions-via-msarat","Chaos Ransomware Hides C2 Traffic in Legitimate Browser Sessions via msaRAT","2026-07-23T16:22:04.374+00:00",{"slug":61,"title":62,"published_at":63},"msarat-malware-hides-c2-traffic-inside-legitimate-browsers","msaRAT Malware Hides C2 Traffic Inside Legitimate Browsers","2026-07-23T10:20:22.121+00:00",{"slug":65,"title":66,"published_at":67},"chinese-hackers-exploit-unpatched-routers-to-build-covert-proxy-network","Chinese Hackers Exploit Unpatched Routers to Build Covert Proxy Network","2026-07-07T20:20:23.447+00:00",[69,74,79,84,88,93],{"slug":70,"name":71,"problem":72,"stories":73},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",13,{"slug":75,"name":76,"problem":77,"stories":78},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",11,{"slug":80,"name":81,"problem":82,"stories":83},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",5,{"slug":85,"name":86,"problem":87,"stories":83},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":89,"name":90,"problem":91,"stories":92},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",4,{"slug":94,"name":95,"problem":96,"stories":97},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",3,[99,105,111,117,121,126,130,134],{"family":100,"item":101,"code":102,"title":103,"together":104},"cis","13","Control 13","Network Monitoring and Defense",18,{"family":106,"item":107,"code":108,"title":109,"together":110},"nist-800-53","sc-7","SC-7","Boundary Protection",12,{"family":112,"item":113,"code":114,"title":115,"together":116},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",10,{"family":106,"item":118,"code":119,"title":120,"together":116},"si-4","SI-4","System Monitoring",{"family":100,"item":122,"code":123,"title":124,"together":125},"12","Control 12","Network Infrastructure Management",8,{"family":106,"item":127,"code":128,"title":129,"together":125},"si-3","SI-3","Malicious Code Protection",{"family":106,"item":131,"code":132,"title":133,"together":125},"ac-17","AC-17","Remote Access",{"family":100,"item":135,"code":136,"title":137,"together":138},"4","Control 4","Secure Configuration of Enterprise Assets and Software",6]