Loading malware…
Fast Reverse Proxy (FRP) is an open-source reverse-proxy and tunneling utility used for legitimate remote connectivity and widely abused during cyber intrusions. It exposes services behind network address translation or firewalls through an externally reachable relay. Its client component establishes an outbound connection to a server component, enabling operators to forward traffic to otherwise inaccessible services, including Remote Desktop Protocol. FRP runs on Windows and Linux, supports TLS-protected connections, and can connect to its server through another proxy.
Threat actors deploy FRP after compromise to maintain remote access, support internal pivoting, relay command-and-control traffic, bypass inbound firewall restrictions, and conceal their originating infrastructure. Observed deployments include standard clients using external configuration and customized builds with embedded configuration or hardcoded callback destinations. Operators have maintained FRP execution through scheduled tasks and used compromised corporate systems as relay servers. These deployment mechanisms are operator-configured rather than evidence that FRP independently compromises hosts or establishes persistence.
FRP has been used by Volt Typhoon, ChamelGang, z0Miner, Hydrochasma, Webworm, COBALT MIRAGE, and CL-UNK-1068. COBALT MIRAGE Cluster B uses the unmodified client, while Cluster A uses a modified variant known as TunnelFish. Associated intrusions span government, critical infrastructure, energy, aviation, telecommunications, shipping, medical laboratories, and other enterprise environments. Its broad legitimate and malicious use means that FRP presence alone does not establish malicious activity or attribution to a particular actor.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
13 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Some operations mixed in reverse tunnels via open-source proxies like Chisel and FRP, sending traffic from compromised devices to upstream infrastructure.
The attackers ... [used] known malicious programs such as FRP, Cobalt Strike Beacon, and Tiny Shell.
The z0Miner threat actor used both the default Frpc and the customized version.
It is worth noting that some of the more recent methods that were observed in attacks attributed to the Phosphorus group included open-source tools such as the famous DiskCryptor library and also BitLocker, along with the Fast Reverse Proxy which is used for RDP proxying.
Following initial access on one machine, the attackers were seen dropping Fast Reverse Proxy (FRP), a tool that can expose a local server that is sitting behind an NAT or firewall to the internet.
COBALT MIRAGE's preferred form of remote access uses the Fast Reverse Proxy (FRPC) tool. While COBALT MIRAGE Cluster A uses a modified version of this tool known as TunnelFish, Cluster B favors the unaltered version.
+7 more in the app. View in Mallory
36 distinct techniques documented for this family, organized by ATT&CK tactic.
Fast Reverse Proxy (FRP) for command and control (C2); Plink for C2; Remote Desktop Protocol (RDP) for lateral movement; BitLocker for data encryption; SoftPerfect Network Scanner for system network configuration discovery.
Every deployed Yarbo robot runs an Greengrass component named com.yarbo.frpc (version 1.0.17) that establishes and maintains a persistent outbound TCP tunnel to a remote server... configured to expose the robot's local SSH service to the internet.
The primary payload, tplink_stager.sh, was designed for post-exploitation of CVE-2024-21833, an OS command injection vulnerability affecting TP-Link Archer and Deco series routers.
Persistence was established for the FRP via scheduled tasks on the domain controller.
The FRP client is deployed with a self-installing persistence mechanism via the start.sh launcher... installs itself into crontab... The FRP client is restarted by cron every minute if the process dies.
For persistence, the threat actor registers their reverse proxies as scheduled tasks, causing the reverse proxy to execute approximately every 20 minutes to communicate with the attacker’s C2 servers.
The FRP client is deployed with a self-installing persistence mechanism via the start.sh launcher: # On first execution, installs itself into crontab (crontab -l ; echo " * * * * * bash $SCRIPT_PATH " ) | crontab -
Use of Publicly Available Exploits: The Phosphorus Group was first seen exploiting the ProxyShell vulnerability, and later on the Log4j vulnerability as well, utilizing fresh exploits in the wild.
The FRP wrapper... includes a complete manual PE mapper (DLLFromMemory class) that operates entirely in user-mode memory... Resolves the exported GoMain function... Invokes GoMain with arguments -c C:\ProgramData\frp\frpc.toml
Persistence was established for the FRP via scheduled tasks on the domain controller.
The FRP client is deployed with a self-installing persistence mechanism via the start.sh launcher... installs itself into crontab... The FRP client is restarted by cron every minute if the process dies.
For persistence, the threat actor registers their reverse proxies as scheduled tasks, causing the reverse proxy to execute approximately every 20 minutes to communicate with the attacker’s C2 servers.
Every deployed Yarbo robot runs an Greengrass component named com.yarbo.frpc (version 1.0.17) that establishes and maintains a persistent outbound TCP tunnel to a remote server... configured to expose the robot's local SSH service to the internet.
A full process tree of a real time attack that exploits the ProxyShell vulnerability and deployment of the FRP modules, can be seen below.
Persistence was achieved via six systemd services... TeamPCP proxy.sh creates six systemd services with Restart=always.
Persistence was established for the FRP via scheduled tasks on the domain controller.
The FRP client is deployed with a self-installing persistence mechanism via the start.sh launcher... installs itself into crontab... The FRP client is restarted by cron every minute if the process dies.
For persistence, the threat actor registers their reverse proxies as scheduled tasks, causing the reverse proxy to execute approximately every 20 minutes to communicate with the attacker’s C2 servers.
Persistence was achieved via six systemd services... TeamPCP proxy.sh creates six systemd services with Restart=always.
"packed using Ultimate Packer for Executables (UPX)"; "UPX compressed"; PE sections include "UPX0/UPX1/UPX2"
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
The FRP wrapper... includes a complete manual PE mapper (DLLFromMemory class) that operates entirely in user-mode memory... Resolves the exported GoMain function... Invokes GoMain with arguments -c C:\ProgramData\frp\frpc.toml
The installation of Horoung caused a conflict with active security products on the system. This resulted in a crash of these services.
MITRE ATT&CK BREAKDOWN ... Impair Defenses: Disable or Modify System Firewall
Once the attackers exploited the vulnerable Microsoft Exchange Server, they downloaded the FRP module, ran multiple reconnaissance commands, created persistence, dumped credentials using a known LOLBIN technique (Comsvcs.dll), and attempted to move laterally.
After establishing the reverse SOCKS proxy connection, the threat actor performed internal reconnaissance and brute forcing attempts on some of the internal FTP servers inside victim network.
Volexity detected a system running frp, otherwise known as fast reverse proxy, and subsequently detected internal port scanning shortly afterward.
Once the attackers exploited the vulnerable Microsoft Exchange Server, they downloaded the FRP module, ran multiple reconnaissance commands, created persistence, dumped credentials using a known LOLBIN technique (Comsvcs.dll), and attempted to move laterally.
TeamPCP a débuté par l’exploitation opportuniste d’infrastructures cloud exposées (APIs Docker non protégées, plans de contrôle Kubernetes, instances Redis mal configurées)
“port 888 handles reverse tunnel connections… sets up… FRP reverse tunneling tools… allow attackers to maintain access even after the initial vulnerability is patched.”
Remote desktop access : Automated patching of termsrv.dll and installation of RDP Wrapper to enable unlimited concurrent RDP sessions...
T1021.004 — Remote Services: SSH (Lateral Movement)
Shared IOCs with Memento Ransomware: One of the IP addresses serves a domain which is being used as command and control (C2) for the recently discovered Memento Ransomware.
The actor has used Earthworm and a custom Fast Reverse Proxy (FRP) client with hardcoded C2 callbacks [T1090].
Figure 15 displays the reverse SOCKS proxy activity on the infected device using the open-source tool FRP.
The FRP client can be configured to connect to the server through a proxy. The server component of SystemBC has used SOCKS5 for C2 communication. Keydnap uses a copy of tor2web proxy for HTTPS communications.
MITRE ATT&CK Techniques Command and Control T1090.003 Proxy: Multi-hop Proxy
Aria-body has the ability to use a reverse SOCKS proxy module... BADHATCH can use SOCKS4 and SOCKS5 proxies... GoBear implements SOCKS5 proxy functionality... Neo-reGeorg has the ability to establish a SOCKS5 proxy... Remcos uses the infected hosts as SOCKS5 proxies...
MITRE ATT&CK Techniques Command and Control T1105 Ingress Tool Transfer
ShadowLink on port 7443; TeamPCP staging on 666, FRP on 888.
“The FRP client establishes a persistent reverse tunnel to the attacker’s server, providing remote access to the device’s ADB service.”
The content repeatedly describes malware and threat actors using SSL, TLS, HTTPS, RSA, AES, Blowfish, RC4, ECIES, Diffie-Hellman, OpenSSL, WolfSSL, and mutual TLS to protect command and control traffic.
Multiple malware families and intrusion sets are described as encrypting C2 traffic using SSL/TLS/HTTPS (e.g., "used HTTPS for command and control", "encrypts C2 communications with TLS", "uses SSL for encrypting C2 communications", "TLS-encrypted WebSocket Protocol (WSS) for C2").
Because the robot connects to the owner's Wi-Fi, an attacker with a root shell can... Exfiltrate data : use the robot's internet connection (via the FRP tunnel) as a covert outbound channel to exfiltrate data from internal hosts
Talos discovered an ongoing espionage campaign in May 2023 targeting an Islamic charitable non-profit organization in Saudi Arabia that exfiltrates data approximately twice a month.
27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
54 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.