Resocks

Resocks is a Go-based reverse proxy/SOCKS-style utility used by multiple threat clusters as a post-compromise access and tunneling tool. Reporting describes it as a readily accessible tool from GitHub that effectively turns a compromised host into a secure relay point. It has been observed packaged in password-protected RAR archives alongside other tunneling tools such as chisel, and deployed after initial compromise to provide proxy access, support remote command execution through relays, and facilitate lateral movement.

High-confidence reporting links Resocks to at least three distinct activity sets. Hydra Saiga (also tracked as Yorotrooper, ShadowSilk, and Silent Lynx), a suspected Kazakhstan-aligned espionage actor, used commodity tools including Resocks together with Telegram-based custom implants, Havoc, and Meterpreter while targeting government, energy, and critical infrastructure organizations across Central Asia, Europe, and the Middle East. In that activity, operators used WMI or PsExec to deploy a reverse SOCKS5 proxy client after domain discovery. Bitdefender also reported heavy use of Resocks by the Curly COMrades espionage cluster targeting judicial and government entities in Georgia and an energy distribution company in Moldova; it was the most frequently observed proxy tool in that campaign. Recovered samples were built with the Go obfuscation utility garble, commonly configured communications over port 443 and in one case 8443, and were persisted via scheduled tasks and Windows services named to resemble legitimate components. Observed Resocks endpoints in that reporting included 91.107.174[.]190, 96.30.124[.]103, 194.87.31[.]171, 75.127.13[.]136, 94.131.109[.]91, and 207.180.194[.]109. In one Moldova case, a Resocks client made an HTTP request to a Redmine server over port 3000 in Ukraine, assessed as a compromised relay. Kaspersky separately reported that the ransomware-linked groups Crypt Ghouls and MorLock used the same Resocks utility.

Overall, the tool is associated with covert network access, proxying, and relay functionality on compromised Windows environments, especially in hands-on-keyboard intrusions where operators need persistent internal access and traffic forwarding.