RSOCX

rsocx is an open-source reverse SOCKS5 proxy tool used by threat actors to tunnel traffic from compromised systems to external infrastructure, enabling covert remote access, pivoting, and post-compromise communications across network boundaries. It has been observed in intrusions as a utility rather than a bespoke malware family, typically deployed after initial access to establish reverse proxy channels from internal hosts or appliances that would otherwise be difficult to reach directly.

Operational reporting links rsocx to multiple intrusion sets and campaigns. Scattered Spider has used rsocx on targeted ESXi appliances during post-compromise operations. PhantomCore has staged and deployed rsocx alongside other remote-access tooling from compromised legitimate servers. It was also used during the 2025 Poland wiper intrusions, including activity associated with DynoWiper deployment, where operators used a reverse SOCKS proxy to tunnel within victim infrastructure and maintain external connectivity.

The tool’s primary role is post-exploitation support: creating reverse connections, relaying traffic, and facilitating lateral access or operator control through SOCKS5 proxying. Its use is consistent with defense evasion and infrastructure-masking tradecraft because it helps adversaries bypass perimeter restrictions, avoid direct inbound exposure, and route follow-on activity through compromised assets. Reported deployments span both Windows and ESXi environments.