{
  "family": "3proxy",
  "sample_count": 12,
  "category": "advanced_threat",
  "description": "HackTool:Win32/3proxy (or simply **3proxy**) is a highly versatile, open-source proxy server. While it is a legitimate administrative tool designed to route network traffic, it is heavily abused by threat actors (acting as a 'Dual-Use Tool' or 'Living off the Land Binary' - LoLBin). Attackers install 3proxy on compromised endpoints (especially home routers, IoT devices, and Windows servers) to silently route their malicious traffic through the victim's IP address, masking their true location.<br><br><b>Understanding 3proxy Abuse</b><br>To an infected user, the presence of 3proxy is entirely invisible; it runs silently in the background. For a threat intelligence analyst, the unauthorized presence of 3proxy indicates that the endpoint has been conscripted into an illegal proxy botnet (like the RSOCKS botnet). Cybercriminals rent access to these proxy networks to conduct credential stuffing attacks, click fraud, or to access geo-blocked banking portals without triggering fraud alerts (since the traffic appears to come from a residential IP).<br><br><b>Execution and Proxy Network Mechanics</b><br>Attackers typically gain access via brute-forcing weak SSH/RDP credentials (`T1110.001`) or exploiting unpatched vulnerabilities (`T1190`). Once they have a foothold, they download the pre-compiled 3proxy executable (`T1105`). They configure it (often via a simple `.cfg` file) to run quietly on a high, non-standard port and establish persistence via a Scheduled Task or systemd service (`T1543`). The attacker's C2 server then registers the victim's IP address as an active proxy node. When a cybercriminal buys proxy access, their traffic is routed through the attacker's server, into the victim's 3proxy instance (`T1090`), and then out to the target website.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is that the victim's IP address is used for illegal activity, potentially leading to their IP being blacklisted by major services (Netflix, banks). Incident responders should investigate EDR alerts for the execution of `3proxy.exe` from unexpected directories (like `%Temp%`). Network logs will show a high volume of inbound connections to a non-standard port, followed immediately by outbound connections to various internet targets, indicative of proxy routing.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1543",
    "T1090.002",
    "T1105",
    "T1110.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1090.002",
      "name": "Connection Proxy: External Proxy (Abusing the tool for routing)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1543",
      "name": "Create or Modify System Process (Establishing persistence)",
      "tactic": "Persistence"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer (Downloading 3proxy)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1110.001",
      "name": "Brute Force: Password Guessing",
      "tactic": "Initial Access"
    }
  ],
  "containment_steps": [
    "Isolate the endpoint to immediately sever the proxy connections being routed through the machine.",
    "Identify and terminate the running `3proxy` process, and delete the associated executable and `.cfg` configuration file.",
    "Audit Scheduled Tasks, Registry Run keys, and Services to remove the persistence mechanism that launches the proxy.",
    "Investigate how the attacker gained initial access (e.g., exposed RDP, weak passwords) and remediate the vulnerability to prevent reinfection."
  ],
  "what_to_avoid": [
    "Do not assume 3proxy is inherently malware; check with system administrators to ensure it wasn't installed legitimately for network routing (though rare on standard endpoints).",
    "Avoid relying solely on file deletion, as the attacker may still have the initial access backdoor (like a web shell or compromised credentials) used to install it."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}