RevSocks

RevSocks is a reverse-SOCKS tunneling and proxy utility used by multiple threat actors to create covert access channels from compromised systems to attacker-controlled infrastructure. It is commonly employed as post-compromise tradecraft rather than as a standalone initial infection payload, enabling operators to proxy traffic such as Remote Desktop Protocol sessions, maintain redundant command-and-control paths, and support data exfiltration or persistent remote access.

The tool has been observed in intrusions involving espionage and disruptive actors, including Mantis (also known as Arid Viper, Desert Falcon, and APT-C-23), Cloud Atlas, MoustachedBouncer, and activity associated with Homeland Justice. In these operations, RevSocks was used on Windows systems as a reverse proxy or reverse SOCKS tunnel, sometimes over port 443, and in some cases alongside Tor or other tunneling utilities to conceal operator origin and preserve access if other channels were removed. It has also been seen in ransomware-related intrusions where attackers combined it with other proxy and tunneling tools to maintain covert connectivity during credential theft, lateral movement, and enterprise-wide deployment activity.

RevSocks is associated with defense evasion and persistence-oriented post-exploitation because it helps attackers traverse network boundaries, bypass inbound access restrictions, and blend malicious traffic into normal outbound communications. Its operational role is to relay attacker traffic through a compromised host, supporting command and control, remote administration, and potentially exfiltration, rather than to deliver a destructive or self-propagating payload itself.