View on MITRE ATT&CK

T1090 - Proxy

Tactics:
Command and Control
Platforms:
ESXi Linux macOS Network Devices +1
Detection:
Not specified
Description:
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including [HTRAN](https://attack.mitre.org/software/S0040), ZXProxy, and ZXPortMap. (Citation: Trend Micro APT Attack Tools) Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.

Adversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.
Sub-techniques (4)
ID ATT&CK Actions
T1090.001 Internal Proxy
T1090.002 External Proxy
T1090.003 Multi-hop Proxy
T1090.004 Domain Fronting
Used by Actors (17)
Turla
Nation-state
Gamaredon Group
Unknown
CopyKittens
Nation-state
APT41
Nation-state
Fox Kitten
Unknown
POLONIUM
Nation-state
Earth Lusca
Unknown
Volt Typhoon
Unknown
MoustachedBouncer
Nation-state
Scattered Spider
Unknown
Sandworm Team
Unknown
Cinnamon Tempest
Unknown
Magic Hound
Unknown
LAPSUS$
Unknown
Windigo
Unknown
Blue Mockingbird
Unknown
Contagious Interview
Unknown
Malware (20)
reGeorg other Ursnif other RansomHub other LITTLELAMB.WOOLTEA other Havoc other AuditCred other RainyDay other NETWIRE other Aria-body other BADHATCH other SombRAT other HOPLIGHT other Green Lambert other Bisonal other KEYPLUG other XTunnel other TSCookie other TYPEFRAME other Sagerunex other SDBbot other
Metadata
MITRE ID: T1090
STIX ID: attack-pattern--731f4f55-b6d0-...
Platforms: ESXi, Linux, macOS, Network Devices, Windows
Created: 13/01/2026 17:48
Updated: 06/03/2026 16:00