value:  menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim. ;; MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2). ;; Okrum can identify proxy servers configured and used by the victim and use it to make HTTP requests to C2 its server. ;; POWERSTATS has connected to C2 servers through proxies. ;; Regin leveraged several compromised universities as proxies to obscure its origin. ;; ShimRat can use pre-configured HTTP proxies. ;; Silence has used ProxyBot which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.
name: Proxy: External Proxy