Skip to content

Internal Proxy

Subtechnique · ATTACK:enterprise:T1090.001

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1090.001",
  "title": "Internal Proxy",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1090/001",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--f6dacc85-b37d-458e-b58d-74fc4bbf5755",
  "external_id": "T1090.001",
  "domain": "enterprise",
  "created": "2020-03-14T23:08:20.244Z",
  "modified": "2026-09-08T20:28:40.517Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "Trend Micro APT Attack Tools",
      "url": "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/"
    }
  ]
}

Explicit source assertions (38)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d383bcc-2aea-4044-a3ff-b42f7b47ecde

Sygnia VelvetAnt 2024A

ATTACK:enterprise:S0556 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1057a87e-4ae4-4317-b655-0fab5a17e7e2

ClearkSky Fox Kitten February 2020 · Check Point Pay2Key November 2020

ATTACK:enterprise:S0038 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1451c4a3-5dc6-4744-8120-197f3a3134c1

Symantec W32.Duqu

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--177d06e3-7e2f-47a1-8bbf-18a4787af5c7

CrowdStrike StellarParticle January 2022 · Symantec RAINDROP January 2021

ATTACK:enterprise:S0023 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--252c0e02-0da6-4812-b147-81d9cfb3c998

ESET Sednit Part 2

ATTACK:enterprise:T1090.001 → subtechnique-of → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--284aadab-ec10-4869-8bdb-7258c19432c4

ATTACK:enterprise:S9010 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--29184298-9a17-4def-8ad8-10381b4bde89

Koi Glassworm InvisibleCode October 2025

ATTACK:enterprise:S9023 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3780f9f1-9698-4e7c-8d02-c5289733b2d8

Trend Micro Earth Kasha NOV 2024

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37e781a4-8ac2-49c9-956d-2c78a5cef3df

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:S0502 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ff468a6-c444-439e-b095-dda4648f3561

NSA/FBI Drovorub August 2020

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--406ca789-682f-4e08-bb7e-60421923ee09

cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020

ATTACK:enterprise:G0126 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49a11d2f-7945-4603-b409-d66420b94533

Zscaler Higaisa 2020

ATTACK:enterprise:S1060 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54b14853-fe7e-484e-ac14-849da168706c

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5a5914f0-4e99-494b-bcf3-b199f623e36d

Mythc Documentation

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5aa77e01-e63e-4be1-9f7e-1792d45a138a

Cisco LotusBlossom 2025

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60ce5523-f376-4c28-9363-a336b4ff2acf

AI-Mexico-Govt-Breach · AI-Mexico-Govt-Compromise

ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--62f3aaef-917b-42fa-9fe9-e21f674caa90

Novetta Winnti April 2015

ATTACK:enterprise:G0041 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6476b9fe-dc7f-4578-a39d-beebc8390af2

Kaspersky ProjectSauron Blog

ATTACK:enterprise:S0051 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e1e9f11-ab28-48cc-b392-f2863707fe11

ESET Dukes October 2019

ATTACK:enterprise:S0512 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--733eae48-a5e2-4e82-b4a6-950c7a660e7e

ESET Dukes October 2019

ATTACK:enterprise:S0265 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75367678-910c-4715-9fc8-ee503f8e41e5

Accenture HyperStack October 2020

ATTACK:enterprise:S0031 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cbedb9a-666f-47eb-b70e-905bcf80940a

ATTACK:enterprise:S0633 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7fde1ea2-8561-4df3-8760-78d65601e305

Cybereason Sliver Undated

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--828d0030-009d-4612-ae30-9dfa3d139e26

CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--864def70-2079-4015-8852-d77e19dd086c

University of Birmingham C2

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--887626bc-bccf-4460-bd4c-af829a178ff9

Kaspersky ToddyCat June 2022 · Kaspersky ToddyCat Check Logs October 2023

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8eafddf4-a5ae-43a0-8129-966de05fefb0

Talos TinyTurla September 2021

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--90974f03-7f61-479e-bceb-6f26872d4812

ESET InvisiMole June 2018

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--97bf5604-4b99-4851-85ea-83018d90c82c

Kaspersky ThreatNeedle Feb 2021

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9a462c0e-a60e-4983-8839-1f0e41cc133a

FoxIT Wocao December 2019

ATTACK:enterprise:S1059 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--af9720b7-fef3-4b8d-b2ad-073355523866

SentinelLabs Metador Technical Appendix Sept 2022

ATTACK:enterprise:S1198 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c0c248e8-491d-41d0-b032-1c59c9f4db1a

Symantec Troll Stealer 2024

ATTACK:enterprise:S0009 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7c40b1d-efe6-4869-9754-6494d45f51f1

ATTACK:enterprise:S1227 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--db355151-5333-430e-8cb9-421bc688f874

ATTACK:enterprise:S9015 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e0137354-4660-4053-ab7d-9f8358ff6ceb

CrowdStrike BRICKSTORM WARP PANDA UNC5221 December 2025 · CISA BRICKSTORM UNC5221 AR25-338A February 2026 · Picus Security BRICKSTORM UNC5221 October 2025 · Google UNC5221 BRICKSTORM SPAWNCHIMERA April 2024 · NVISO BRICKSTORM April 2025 · Google BRICKSTORM September 2025

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2ebd73f-9198-49c7-b446-00478a466e78

FireEye APT39 Jan 2019 · BitDefender Chafer May 2020

ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3549420-15ec-4747-9988-7dfdbdb1e7d7

Nicolas Falliere, Liam O Murchu, Eric Chien February 2011

ATTACK:enterprise:C0051 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f09c6fc6-0d2d-4ca8-858c-107351cff26c

Nearest Neighbor Volexity

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.