Skip to content

External Proxy

Subtechnique · ATTACK:enterprise:T1090.002

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1090.002",
  "title": "External Proxy",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1090/002",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--69b8fd78-40e8-4600-ae4d-662c9d7afdb3",
  "external_id": "T1090.002",
  "domain": "enterprise",
  "created": "2020-03-14T23:12:18.466Z",
  "modified": "2026-09-08T20:29:07.652Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "Trend Micro APT Attack Tools",
      "url": "http://blog.trendmicro.com/trendlabs-security-intelligence/in-depth-look-apt-attack-tools-of-the-trade/"
    }
  ]
}

Explicit source assertions (28)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S1084 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0640af26-888f-4022-ab72-2d0a69dd9bb0

Mandiant APT29 Eye Spy Email Nov 22

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--073aff0c-1dd2-40f4-87da-d90809f3418a

BitDefender Chafer May 2020

ATTACK:enterprise:S0444 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d1314fe-7fd6-4816-abb8-4b9872478807

FOX-IT May 2016 Mofang

ATTACK:enterprise:S0650 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0fae3830-5845-414a-8429-b95745b3db32

Kaspersky QakBot September 2021

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10cc3288-d06c-456c-bc0e-b10a8c5abeaa

Bitdefender APT28 Dec 2015 · FireEye APT28 · DOJ GRU Indictment Jul 2018

ATTACK:enterprise:G0053 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--11f6ad22-0293-47bd-95d1-34bf4ee1de9e

Mandiant FIN5 GrrCON Oct 2016

ATTACK:enterprise:G0131 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1dcca5db-e03e-4330-8705-76aaedcf295f

TrendMicro Tonto Team October 2020

ATTACK:enterprise:S0699 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--25ffefb1-15cc-4365-b401-b2975494f36b

Mythc Documentation

ATTACK:enterprise:S0141 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2fadf189-bdcf-44b8-933a-ca6188485058

Novetta Winnti April 2015

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--39fdd17c-5f59-4daf-bf14-95841b5ec248

US-CERT FALLCHILL Nov 2017 · TrendMicro macOS Dacls May 2020

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a2d591a-f918-44b3-9e75-7520906b9aa3

FireEye APT10 April 2017 · FireEye APT10 Sept 2018

ATTACK:enterprise:M1031 → mitigates → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c67124e-e215-4c33-aff7-7a7b98735a0f

University of Birmingham C2

ATTACK:enterprise:T1090.002 → subtechnique-of → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d16dbff-d1fc-42e0-b736-69ddee747ffe

ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f76fd4d-a638-41a0-90b9-bd4ada6f93f3

FireEye Operation Double Tap

ATTACK:enterprise:S0019 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52cf8793-2f13-45c2-8274-1a9bf5d6224a

Kaspersky Regin

ATTACK:enterprise:S0223 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fb86c58-666c-4a5f-bdd1-417a77761e6f

FireEye MuddyWater Mar 2018

ATTACK:enterprise:C0055 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7063b404-bd10-4971-b207-70120180e20d

Bitsight 7777 Botnet · Microsoft Storm-0940

ATTACK:enterprise:G0091 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--89077d0b-aaa2-48b9-90d7-e253a550bfad

Group IB Silence Sept 2018

ATTACK:enterprise:S0439 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95e5fd0e-b9c1-4efa-b462-a922456401e6

ESET Okrum July 2019

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a084527d-2858-4037-bc48-68c1eac85acb

Cybereason Soft Cell June 2019

ATTACK:enterprise:S9003 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a3a71677-e8d4-4d56-8429-50c3ec8fac85

Sophos Evilginx MAR 2025 · Breakdev Evilginx 2.4 SEP 2020 · Evilginx 2 July 2018

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8085af7-fcbb-4c1d-8eef-0ae509dac516

NCSC et al APT29 2024

ATTACK:enterprise:S9061 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bafb0712-7479-4a18-9f49-ed0a8f217e74

Mandiant_UNC1549TTPsTools_Nov2025 · Mandiant_UNC1549_Feb2024

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc78f0a1-7f4f-491e-a636-910f09d0c5a1

ESET_MuddyWater_Dec2025 · Trend Micro Muddy Water March 2021 · Reaqta MuddyWater November 2017 · Symantec MuddyWater Dec 2018

ATTACK:enterprise:S9045 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ce3bead8-5d34-4d9a-aee4-d7f86b583260

AI-Mexico-Govt-Breach

ATTACK:enterprise:S0266 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e014c5a8-f9bc-4de5-aa46-55765ac4461c

Bitdefender Trickbot C2 infra Nov 2020 · Bitdefender Trickbot VNC module Whitepaper 2021

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e37d2896-d79e-4f97-a430-ef6e822c6871

AI-Mexico-Govt-Breach

ATTACK:enterprise:S0260 → uses → ATTACK:enterprise:T1090.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e3e55e40-d284-4c43-9602-145d6643bc7b

ESET InvisiMole June 2018 · ESET InvisiMole June 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.