Loading malware…
Resocks is a publicly available, Go-based reverse SOCKS5 proxy utility used by threat actors to tunnel traffic through compromised computers. It turns an infected host into a relay for access to internal network resources, supporting post-exploitation remote access and lateral movement. Its availability and use by multiple unrelated groups make its presence insufficient for attribution on its own.
Resocks has been deployed on Windows systems by Shedding Zmiy, Crypt Ghouls, MorLock, Hydra Saiga, and Curly COMrades. Associated intrusions have affected Russian government agencies and businesses, including energy companies and IT contractors, as well as government and judicial organizations in Georgia and an energy distribution company in Moldova. Operators have deployed the proxy through remote-execution mechanisms such as WMI and PsExec. Curly COMrades maintained proxy access using scheduled tasks and Windows services with legitimate-looking names; recovered Resocks builds were obfuscated with the Go utility garble and commonly configured to communicate over port 443. Shedding Zmiy deployed modified Resocks clients disguised as legitimate software, and reuse of a normally randomized connection key linked deployments across separate intrusions. Resocks is a dual-use networking tool rather than an inherently malicious implant.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
resocks appeared as C:\svchost.exe in the energy-sector case and as C:\ProgramData\Acronis\acronis.exe in the contractor case.
These tools were commonly packaged in password-protected RAR archives, and ranged from reverse proxy clients like resocks and tunnelling software like chisel...
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Open-source tools: Neo-reGeorg, resocks, revsocks, patator
"used either Windows Management Instrumentation (WMI) or PsExec to download and execute a reverse socks5 proxy client"
"used either Windows Management Instrumentation (WMI) or PsExec"
...resocks SOCKS5 proxy for remote access
Multiple SOCKS proxy layers on ports 1080, 1085, 10800, 10843, 10850, 10555, 10830
Resocks/Revsocks encrypted reverse SOCKS, Neo-reGeorg, ICMP tunneling
AES-encrypted PowerShell payload, Resocks encrypted tunnels with pre-shared keys
13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.