T1090Command and Control
Proxy
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage…
CVEs13
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.13
Reports1
Detections
22 Sigma rules tagged T1090ProxyT109022 general rules
- Communication To LocaltoNet Tunneling Service Initiatedhightest
- Communication To LocaltoNet Tunneling Service Initiated - Linuxhightest
- Communication To Ngrok Tunneling Service - Linuxhightest
- Communication To Ngrok Tunneling Service Initiatedhightest
- HackTool - Htran/NATBypass Executionhightest
- Malicious IP Address Sign-In Failure Ratehightest
- Malicious IP Address Sign-In Suspicioushightest
- Ngrok Usage with Remote Desktop Servicehightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Proxy
13 CVEs, by priority. Each link shows its badge.- CVE-2021-26855Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft · Exchange ServerKEVRansomwarePublic exploitCritical · 9.1T1133External Remote ServicesT1505.003Web Shell+2 more · 5 reportsMITRE CTID mapping of the KEV entry · primary impact>99.9%Top 0.01%89.4priority
- CVE-2026-15409SonicWall SMA1000 Appliances Server-Side Request Forgery VulnerabilitySonicWall · SMA1000 AppliancesKEVRansomwarePublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1090Proxy1 reportAI mapping from the description · primary impact6.8%Top 6%87.7priority
- CVE-2019-3396Atlassian Confluence Server and Data Center Server-Side Template Injection VulnerabilityAtlassian · Confluence Server and Data ServerKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1202Indirect Command Execution+1 more · 1 reportMITRE CTID mapping of the KEV entry · primary impact99.9%Top 0.03%83.7priority
- CVE-2021-22986F5 BIG-IP and BIG-IQ Centralized Management iControl REST Remote Code Execution VulnerabilityF5 · BIG-IP and BIG-IQ Centralized ManagementKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1190Exploit Public-Facing Application+3 moreMITRE CTID mapping of the KEV entry · primary impact99.9%Top 0.03%79.9priority
- CVE-2021-40438Apache HTTP Server-Side Request Forgery (SSRF)Apache · ApacheKEVRansomwarePublic exploitCritical · 9.0T1190Exploit Public-Facing ApplicationT1090ProxyAI mapping from the description · primary impact>99.9%Top 0.01%79.3priority
- CVE-2026-64849MLflow Server-Side Request Forgery VulnerabilityAI mapping from the description · primary impact10.0%Top 4.4%78.6priority
- CVE-2026-96652Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityAI mapping from the description · primary impact1.8%Top 21%71.2priority
- CVE-2020-7796Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery VulnerabilitySynacor · Zimbra Collaboration SuiteKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1090ProxyAI mapping from the description · primary impact93.6%Top 0.16%69.8priority
- CVE-2021-22175GitLab Server-Side Request Forgery (SSRF) VulnerabilityAI mapping from the description · primary impact53.4%Top 1%69.7priority
- CVE-2019-9621Synacor Zimbra Collaboration Suite (ZCS) Server-Side Request Forgery (SSRF) VulnerabilitySynacor · Zimbra Collaboration Suite (ZCS)KEVPublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1090ProxyAI mapping from the description · primary impact81.0%Top 0.37%68.2priority
- CVE-2021-21311Adminer Server-Side Request Forgery VulnerabilityAI mapping from the description · primary impact98.5%Top 0.08%68.0priority
- CVE-2016-3718ImageMagick Server-Side Request Forgery (SSRF) VulnerabilityAI mapping from the description · primary impact75.6%Top 0.48%66.8priority
- CVE-2026-96655Plex Media Server Server-Side Request Forgery (SSRF) VulnerabilityAI mapping from the description · primary impact1.6%Top 24%65.7priority
Linked through a sub-technique
1 more- CVE-2021-22017VMware vCenter Server Improper Access ControlVMware · vCenter ServerKEVPublic exploitMedium · 5.3T1190Exploit Public-Facing ApplicationT1090.001Internal Proxy49.2%Top 1.1%66.5priority