{
  "family": "redirected",
  "sample_count": 2,
  "category": "trojan",
  "description": "Behavior:Win32/Redirected is a severe **Heuristic Detection** that flags unauthorized changes to the system's network configuration aimed at intercepting, monitoring, or manipulating outbound web traffic. This behavior is typically exhibited by advanced adware, banking trojans, and sophisticated Man-in-the-Middle (MitM) spyware attempting to capture credentials or inject malicious content into legitimate websites.<br><br><b>Understanding Redirected (Traffic Proxying)</b><br>To an end-user, this behavior might manifest as SSL certificate errors on usually secure sites (like banks), inexplicably slow browsing speeds, or an overwhelming number of injected advertisements on legitimate pages. For a security analyst, a Redirected alert indicates a critical breach of network integrity (`T1562.004`). The malware has successfully positioned itself between the user's browser and the internet.<br><br><b>Execution and Hijacking Mechanics</b><br>Malware triggers this detection through several techniques. It may modify the system-wide Windows Proxy Settings via the Registry (`T1112`), forcing all browser traffic through a locally hosted proxy server controlled by the malware. Alternatively, it might install a malicious Root Certificate Authority (CA) into the Windows Certificate Store (`T1553.004`), allowing the local proxy to seamlessly decrypt, inspect, and re-encrypt HTTPS traffic (TLS inspection) without triggering browser warnings. The malware can then steal credentials or inject banking trojan 'web injects' (`T1185`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of confidentiality for all web traffic originating from the endpoint. Host-based IoCs include EDR alerts for modifications to `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer`, the unexpected installation of new Root Certificates, or unknown processes listening on local ports (like `127.0.0.1:8080`). Network IoCs might include all outbound HTTP/HTTPS traffic routing to a single, unexpected external IP address.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1562.004",
    "T1553.004",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall (Modifying Proxy Settings)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1553.004",
      "name": "Subvert Trust Controls: Install Root Certificate (Enabling MitM)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Injecting malicious content via local proxy)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; all communications, including credentials typed into secure websites, are actively being intercepted.",
    "Open the Windows Internet Options and manually disable any unauthorized proxy server settings.",
    "Audit the Windows Certificate Manager (`certmgr.msc`) and remove any suspicious or recently installed Root Certificate Authorities.",
    "Initiate an enterprise-wide password reset for the user, assuming all recently used credentials have been compromised via the MitM attack."
  ],
  "what_to_avoid": [
    "Do not allow the user to log into any corporate portals until the proxy settings and rogue certificates are completely removed.",
    "Avoid assuming a simple AV scan will fix the issue; AVs often miss the rogue Root Certificates which must be removed manually."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}