value:  FatDuke can used pipes to connect machines with restricted internet access to remote machines via other infected hosts. ;; Higaisa discovered system proxy settings and used them if available. ;; Hikit supports peer connections. ;; InvisiMole can function as a proxy to create a server that relays communication between the client and C&C server or between two clients. ;; Kazuar has used internal nodes on the compromised network for C2 communications. ;; MiniDuke can can use a named pipe to forward communications from one compromised machine with internet access to other compromised machines. ;; Operation Wocao can proxy traffic through multiple infected systems. ;; Pay2Key has designated machines in the compromised network to serve as reverse proxy pivot points to channel communications with C2. ;; Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access. ;; UNC2452 configured at least one instance of Cobalt Strike to use a network pipe over SMB during the 2020 SolarWinds intrusion.";;APT group SparklingGoblin often deploy SideWalk, a backdoor which utilises shellcode containing C2 domains which are communicated with through the use of an internal proxy. ;; Pysa, a prolific ransomware group, utilises a Chisel tunneling tool named MagicSocks to obfuscate malicious, outbound traffic. ;; SOCKS proxy tool Earthworm is a commonly distributed proxy tool that hosts a variety of functionality for communication with outside networks. 
name: Proxy: Internal Proxy