Where Residential Proxies Fit in MITRE ATT&CK

2023-05-17T13:00:00+10:00

MITRE ATT&CK gives defenders a precise way to describe how an adversary uses a proxy inside an intrusion. That precision is useful. It is also easy to lose when every login attempt, scrape or fraudulent checkout routed through a residential IP is labelled T1090.

ATT&CK technique T1090 belongs to the Command and Control tactic. It describes adversaries directing network traffic through an intermediary to avoid a direct connection to their infrastructure, maintain resilient communications or use a trusted path between systems.

That scope includes compromised routers acting as relays. It does not make T1090 a general classification for residential proxy traffic on the public web.

What T1090 Actually Covers

MITRE divides T1090 into four sub-techniques:

T1090.001 Internal Proxy: traffic is relayed through a system inside the target environment.
T1090.002 External Proxy: an external intermediary, such as a VPN or other proxy service, conceals the adversary's connection.
T1090.003 Multi-hop Proxy: several intermediaries are chained together.
T1090.004 Domain Fronting: a content delivery or hosting route is used to disguise the intended command-and-control destination.

The common thread is adversary communications. A proxy helps the operator reach a command-and-control server, route into another system or hide the infrastructure behind the operation.

A residential exit may be one of those intermediaries. The address type is not what creates the ATT&CK mapping. The proxy's role in the intrusion does.

Horse Shell Is a Relevant Example

In 2023, Check Point Research analysed Horse Shell, a custom implant found in modified TP-Link router firmware associated with activity it tracks as Camaro Dragon.

Horse Shell could execute commands, transfer files and create a SOCKS5 tunnel through the compromised router. That last capability let an operator relay traffic through the victim's connection and use the router as anonymous infrastructure. This is the kind of behaviour T1090 is designed to describe.

Attribution needs the same care as technique mapping. Check Point found significant overlaps between Camaro Dragon and activity publicly associated with Mustang Panda. Its report explicitly stopped short of saying the two labels represented exactly the same group.

The research also did not establish that Horse Shell was used for credential stuffing, account takeover or DDoS. Those are plausible uses for proxy infrastructure in general, but they are not findings from this incident.

Volt Typhoon Shows the Wider Infrastructure Model

MITRE lists Volt Typhoon as a T1090 procedure example. Joint government reporting says the group used compromised small-office and home-office routers, virtual private servers and multi-hop proxies to conceal command-and-control traffic.

Several ATT&CK concepts can describe different parts of that operation:

T1090 Proxy describes the relaying of command-and-control traffic.
T1583.003 Acquire Infrastructure: Botnet can describe obtaining access to botnet capacity.
T1584.005 Compromise Infrastructure: Botnet can describe compromising devices that are then used as operational infrastructure.

These mappings should not be collapsed into “residential proxies were used for data exfiltration”. An intrusion may include collection and exfiltration as separate behaviours, while the proxy infrastructure conceals or carries command-and-control traffic. ATT&CK works because those actions remain separate.

Public-Web Abuse Is a Different Defensive Problem

Residential proxies are also used for credential stuffing, fake account creation, scraping, ad fraud, checkout abuse and other activity directed at public applications. The operator buys or controls an exit, then sends an otherwise ordinary web request through it.

That request may not be part of an enterprise intrusion or command-and-control channel. ATT&CK is therefore not the right taxonomy for every part of the event.

For an application team, the useful questions are closer to the request:

Which route is being used?
Is the client testing credentials, creating accounts or extracting data?
Does the behaviour continue across changing IP addresses?
Do the network, browser and session observations agree?
What action can reduce the harm without blocking unrelated users on the same ISP or carrier address?

Residential proxy detection supplies one part of that evidence. The policy still needs route, account, fingerprint, behaviour and outcome context.

Defend the Two Surfaces Separately

An enterprise network and a public application observe different sides of proxy use.

Endpoint and network teams looking for T1090 should investigate unauthorised tunnelling and traffic bridging: unexpected proxy processes, port-forwarding changes, compromised routers, unusual outbound destinations and connections that let an external operator reach internal systems. MITRE's current detection guidance focuses on that setup and relay behaviour.

Application and fraud teams see requests after the relay has already done its job. They should correlate the proxy signal with the protected route and the work being attempted. A public article request may be logged. A login sequence testing exposed credentials may be challenged or rate limited across account and client cohorts. A high-risk account change may require stronger verification.

IP reputation remains useful in both cases, but it is not identity. A household address can carry legitimate traffic and relayed traffic at the same time. A fresh exit can also be active before a static feed records it.

Use ATT&CK at Its Actual Resolution

T1090 is a sound description when a proxy carries or conceals adversary command-and-control communications. Horse Shell and Volt Typhoon show why compromised edge devices matter in that context.

The framework does not say that every residential proxy request is command and control, nor that proxy detection alone establishes malicious intent. Keep the mapping attached to the observed behaviour. Use application controls for the public request, and ATT&CK techniques for the intrusion activity they actually describe.

For the sourcing side of the problem, read How Residential Proxy Networks Are Formed. For application policy, continue with Proxy Signals and Security Decisions.