{
  "family": "ultrasurf",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "PUA:Win32/Ultrasurf represents a unique classification in enterprise security. Technically, Ultrasurf is a freeware Internet censorship circumvention tool, originally designed to allow users in restrictive countries to bypass national firewalls via an encrypted proxy network. However, in a corporate environment, it is almost universally classified as a Potentially Unwanted Program (PUA) or Riskware because it actively subverts enterprise security controls, bypasses content filtering, and creates an unmonitored encrypted tunnel out of the network.<br><br><b>Understanding Ultrasurf in the Enterprise</b><br>To an end-user, Ultrasurf is a convenient way to access blocked websites (like social media or streaming services) from the office. For a security operations center (SOC) or network administrator, Ultrasurf is a massive compliance and security risk. By tunneling traffic through external proxies, it renders Data Loss Prevention (DLP) systems, malware inspection, and acceptable use policies completely blind (`T1562.004`). Furthermore, third-party repackaged versions of Ultrasurf frequently bundle aggressive adware or spyware.<br><br><b>Execution and Evasion Mechanics</b><br>Ultrasurf is uniquely designed for stealth. It is usually a single, portable executable (`u.exe`) that requires no installation or administrative privileges (`T1204.002`), meaning any user can run it. Upon execution, it establishes an encrypted TLS connection to a proprietary network of proxy servers (`T1090.003`). It then dynamically alters the local endpoint's Windows Internet Options (`inetcpl.cpl`) (`T1562`), forcing all local web browsers (IE, Chrome, Edge) to route their HTTP/HTTPS traffic through a local loopback port (e.g., `127.0.0.1:9666`), which Ultrasurf then encrypts and sends out through its proxy tunnel. Upon closure, it attempts to clean up its tracks and restore the proxy settings.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total bypass of perimeter security controls and potential exposure to unvetted external networks. Host-based IoCs include EDR alerts for the execution of unsigned portable executables from the `%Downloads%` or `%Temp%` folders, followed immediately by modifications to the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer` registry key. Network IoCs include a high volume of encrypted TLS traffic flowing to unknown, rapidly changing IP addresses over standard port 443.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1204.002",
    "T1562",
    "T1090.003",
    "T1562.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1090.003",
      "name": "Proxy: Multi-hop Proxy (Tunneling traffic via Ultrasurf network)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall (Bypassing enterprise web filters)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Portable execution)",
      "tactic": "Execution"
    },
    {
      "id": "T1562",
      "name": "Impair Defenses (Modifying local proxy settings)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Terminate the Ultrasurf process. Ensure the user's local proxy settings (`inetcpl.cpl`) are restored to the corporate default, otherwise they will lose all internet access.",
    "Implement Application Control (like Windows AppLocker or WDAC) to block the execution of known Ultrasurf hashes and unapproved portable executables.",
    "Configure Next-Generation Firewalls (NGFW) to block the specific Ultrasurf application signature, rather than just IP addresses (which change constantly).",
    "Remind users of the corporate Acceptable Use Policy regarding the bypass of security controls."
  ],
  "what_to_avoid": [
    "Do not rely on IP blocklisting to stop Ultrasurf; it dynamically utilizes hundreds of proxy servers and cloud providers to evade static blocks.",
    "Avoid assuming the tool is benign; repackaged versions from unofficial sources often contain secondary malware payloads."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}