Home/ MITRE Matrix/ Command and Control/ T1090.003

T1090.003Multi-hop Proxy

T1090.003 — Multi-hop Proxy is a MITRE ATT&CK technique in the Command and Control tactic. Clankerusecase tracks 12 detection use cases covering it and 6 threat-intel articles citing it.

Command and Control

View on the matrix → Filter Detection Library MITRE official spec ↗

12Use cases

6Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1090 · Proxy

Use cases covering this technique (12)

1Password activity from Tor exit node Internal delivery · alerting DD Application user activity from Tor Internal delivery · alerting DD Google Workspace access from Tor exit node Internal delivery · alerting DD Windows TOR Client Execution ESCU actions · hunting P Cisco SA - Access to Anonymizer Services ESCU actions · hunting P TOR Traffic ESCU actions · alerting P [LLM] Corporate sign-in from DPRK IT-worker VPS / AstrillVPN infrastructure (Famous Chollima) Bespoke delivery · hunting DSΣPDD [LLM] Managed endpoint network egress to DPRK IT-worker VPS / AstrillVPN IPs Bespoke c2 · hunting DSΣPDDCS [LLM] Egress to AI-tool anonymizing proxy code.newcli[.]com (knaithe/KnYuan campaign) Bespoke c2 · alerting DSΣPDDCS [LLM] IronWorm C2 beacon to hardcoded IPs and Tor endpoints from temp-dir process Bespoke c2 · hunting DSΣPDDCS [LLM] Salesforce connected-app OAuth access from first-seen ISP / anonymizing proxy (stolen-token reuse) Bespoke exploit · hunting DSP [LLM] Session/Oxen P2P exfil DNS or TCP to getsession.org from build/CI host Bespoke c2 · alerting DSΣPDD

Articles citing this technique (6)

crit North Korean Remote Workers Are Infiltrating Government and Businesses: How to Expose Them Before Hiring art-59

crit Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks art-170

crit jscrambler npm package publishes malicious preinstall binary art-290

high When a vendor's breach becomes yours: lessons from the Klue incident art-356

crit Webworm: New burrowing techniques art-459

crit TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack art-488