[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1090":3},{"item":4,"lessons":18,"controls":69,"related":99},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1090","T1090","Proxy",19,"MITRE","**What attackers do.** Attackers route traffic through intermediary systems, such as compromised hosts, rented servers, residential proxy networks or anonymising services, to hide where it really comes from or to reach systems that are not directly reachable. This serves the Command and Control tactic.\n\n**How to defend.** Restrict outbound connections to known proxies and block anonymising networks where business allows. Inside the network, monitor for hosts acting as relays between segments. On the identity side, use reputation data on residential proxies and anonymisers when evaluating logins.\n\n**Signs to look for.** Look for internal hosts listening on unusual ports and forwarding traffic, connections to known proxy or anonymisation infrastructure, and logins whose source changes rapidly between unrelated networks. A common gap is that residential proxies make malicious logins appear to come from ordinary home connections.","Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.\n\nAdversaries can also take advantage of routing schemes in Content Delivery Networks (CDNs) to proxy command and control traffic.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1090\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":19,"list":20},27,[21,25,29,33,37,41,45,49,53,57,61,65],{"slug":22,"title":23,"published_at":24},"white-house-network-found-routing-residential-proxy-traffic","White House Network Found Routing Residential Proxy Traffic","2026-11-06T23:21:01.021+00:00",{"slug":26,"title":27,"published_at":28},"residential-proxy-sdk-hidden-in-streaming-apps-exfiltrates-traffic-from-white-house-network","Residential Proxy SDK Hidden in Streaming Apps Exfiltrates Traffic from White House Network","2026-11-06T11:20:39.988+00:00",{"slug":30,"title":31,"published_at":32},"white-house-network-ips-rented-out-via-proxy-services-due-to-unauthorized-device","White House Network IPs Rented Out via Proxy Services Due to Unauthorized Device","2026-11-05T14:21:28.833+00:00",{"slug":34,"title":35,"published_at":36},"residential-proxy-nodes-found-operating-inside-white-house-network","Residential Proxy Nodes Found Operating Inside White House Network","2026-11-05T05:20:26.679+00:00",{"slug":38,"title":39,"published_at":40},"volt-typhoons-silent-train-exploits-unpatched-control-plane-devices-to-infiltrate-critical-infrastru","Volt Typhoon's Silent Train Exploits Unpatched Control Plane Devices to Infiltrate Critical Infrastructure","2026-10-29T16:23:08.637+00:00",{"slug":42,"title":43,"published_at":44},"volt-typhoons-silent-train-network-exploits-zero-days-against-us-targets","Volt Typhoon's Silent Train Network Exploits Zero-Days Against U.S. Targets","2026-10-29T13:20:24.757+00:00",{"slug":46,"title":47,"published_at":48},"volt-typhoons-silent-train-zero-day-exploitation-via-covert-sohoiot-network","Volt Typhoon's Silent Train: Zero-Day Exploitation via Covert SOHO\u002FIoT Network","2026-10-28T19:20:24.612+00:00",{"slug":50,"title":51,"published_at":52},"volt-typhoons-silent-train-exposes-critical-infrastructure-via-ephemeral-proxy-networks","Volt Typhoon's 'Silent Train' Exposes Critical Infrastructure via Ephemeral Proxy Networks","2026-10-28T17:22:31.408+00:00",{"slug":54,"title":55,"published_at":56},"avisloader-exploits-clickfix-social-engineering-and-tox-p2p-for-resilient-c2","AvisLoader Exploits ClickFix Social Engineering and Tox P2P for Resilient C2","2026-09-24T10:20:39.211+00:00",{"slug":58,"title":59,"published_at":60},"residential-proxies-and-vpns-are-defeating-edge-security-controls","Residential Proxies and VPNs Are Defeating Edge Security Controls","2026-09-01T16:21:32.91+00:00",{"slug":62,"title":63,"published_at":64},"chinese-state-hackers-exploited-iot-botnets-and-proxy-tools-to-breach-us-agencies","Chinese State Hackers Exploited IoT Botnets and Proxy Tools to Breach US Agencies","2026-08-26T20:21:48.416+00:00",{"slug":66,"title":67,"published_at":68},"fbi-dismantles-chinese-espionage-proxy-network-targeting-us-critical-infrastructure","FBI Dismantles Chinese Espionage Proxy Network Targeting U.S. Critical Infrastructure","2026-08-26T16:21:55.36+00:00",[70,75,80,85,89,94],{"slug":71,"name":72,"problem":73,"stories":74},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",17,{"slug":76,"name":77,"problem":78,"stories":79},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",14,{"slug":81,"name":82,"problem":83,"stories":84},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",7,{"slug":86,"name":87,"problem":88,"stories":84},"threat-intelligence","Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",{"slug":90,"name":91,"problem":92,"stories":93},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",5,{"slug":95,"name":96,"problem":97,"stories":98},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",4,[100,106,112,118,122,126,130,135],{"family":101,"item":102,"code":103,"title":104,"together":105},"cis","13","Control 13","Network Monitoring and Defense",22,{"family":107,"item":108,"code":109,"title":110,"together":111},"nist-800-53","sc-7","SC-7","Boundary Protection",12,{"family":113,"item":114,"code":115,"title":116,"together":117},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",10,{"family":107,"item":119,"code":120,"title":121,"together":117},"si-4","SI-4","System Monitoring",{"family":101,"item":123,"code":124,"title":125,"together":117},"12","Control 12","Network Infrastructure Management",{"family":107,"item":127,"code":128,"title":129,"together":117},"si-2","SI-2","Flaw Remediation",{"family":101,"item":131,"code":132,"title":133,"together":134},"7","Control 7","Continuous Vulnerability Management",9,{"family":136,"item":137,"code":138,"title":139,"together":140},"iso-27001","a-8-8","Annex A 8.8","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of technical vulnerabilities",8]