T1090.003 Multi-hop Proxy

Technique: T1090.003
Tactics: Command and Control
Research, 90 days: 3
KEV CVEs mapped: 0
SigmaHQ rules: 3
Elastic, Splunk: 5
thrunt rules: 0
Upstream: https://attack.mitre.org/techniques/T1090/003

MITRE description

Adversaries may chain together multiple proxies to disguise the source of malicious traffic. Typically, a defender will be able to identify the last proxy traffic traversed before it enters their network; the defender may or may not be able to identify any previous proxies before the last-hop proxy. This technique makes identifying the original source of the malicious traffic even more difficult by requiring the defender to trace malicious traffic through several proxies to identify its source. For example, adversaries may construct or use onion routing networks – such as the publicly available [Tor](https://attack.mitre.org/software/S0183) network – to transport encrypted C2 traffic through a compromised population, allowing communication with any device within the network.(Citation: Onion Routing) Adversaries may also use operational relay box (ORB) networks composed of virtual private servers (VPS), Internet of Things (IoT) devices, smart devices, and end-of-life routers to obfuscate their operations.(Citation: ORB Mandiant) In the case of network infrastructure, it is possible for an adversary to leverage multiple compromised devices to create a multi-hop proxy chain (i.e., [Network Devices](https://attack.mitre.org/techniques/T1584/008)). By leveraging [Patch System Image](https://attack.mitre.org/techniques/T1601/001) on routers, adversaries can add custom code to the affected network devices that will implement onion routing between those nodes. This method is dependent upon the [Network Boundary Bridging](https://attack.mitre.org/techniques/T1599) method allowing the adversaries to cross the protected network boundary of the Internet perimeter and into the organization’s Wide-Area Network (WAN). Protocols such as ICMP may be used as a transport. Similarly, adversaries may abuse peer-to-peer (P2P) and blockchain-oriented infrastructure to implement routing between a decentralized network of peers.(Citation: NGLite Trojan)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

2026-10-22 Huntress: M365 Token Spray and Replay Campaign Compromises Business Email Accounts
2026-10-22 ESET: MythicRatatoskr: An Yggdrasil-enabled backdoor deployed in a UAC-0099-Sandworm collaboration
2026-09-02 Huntress: Inside Knight Office, a New M365 AiTM Phishing Kit

Detection coverage

SigmaHQ community rules

Query Tor Onion Address - DNS Client (core)
DNS Query Tor .Onion Address - Sysmon (core)
Tor Client/Browser Execution (core)

Elastic and Splunk rules

ProxyChains Activity (elastic)
Suspicious Utility Launched via ProxyChains (elastic)
Windows TOR Client Execution (splunk)
Cisco SA - Access to Anonymizer Services (splunk)
TOR Traffic (splunk)

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.