StarProxy

StarProxy is a Windows post-compromise proxying utility associated with the China-linked espionage group Mustang Panda. It is used to relay attacker communications through compromised hosts, enabling access to internal systems that are not directly exposed to the internet and supporting lateral movement within victim networks. The tool has been described as complementing the TONESHELL malware family in intrusions targeting organizations such as governments, military entities, NGOs, telecommunications, and think tanks, particularly in East Asia, Myanmar, and parts of Europe.

StarProxy is commonly executed through DLL side-loading using legitimate signed software, including observed use with IsoBurner. It accepts command-line parameters for network communication and uses Windows APIs during execution. Its core function is to proxy traffic between infected devices and command-and-control infrastructure. StarProxy supports both TCP and UDP in code, although reported samples were hardcoded for TCP in observed operations.

A notable feature of StarProxy is its use of FakeTLS to disguise command-and-control traffic. It crafts network traffic with TLS-like record headers to impersonate legitimate TLS versions, helping communications blend with normal encrypted traffic and complicating inspection. Reported implementations also used custom XOR-based protection for exchanged data. These behaviors indicate a design focused on stealthy internal pivoting, operational security, and maintaining communications across segmented networks.

At high confidence, StarProxy is best characterized as a proxying backdoor-style utility used after initial compromise rather than as an initial access payload. Its documented behavior centers on covert communications, internal traffic relaying, command execution via the command line, and support for attacker movement and post-exploitation activity inside compromised Windows environments.