MalwareUsed by 1 actor

PHProxy

PHProxy is an open-source web proxy written in PHP. In the provided reporting, North Korea-linked threat actor Kimsuky used actor-modified versions of PHProxy as an adversary-in-the-middle capability to examine web traffic between victims and accessed websites and to collect credentials entered by victims. The content directly associates this modified PHProxy usage with Kimsuky’s intelligence-collection operations targeting individuals, think tanks, and government-related entities, particularly in South Korea, Japan, and the United States. High-confidence behavior mentioned in the content is limited to web-traffic inspection and credential collection via modified PHProxy instances.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Kimsuky

Kimsuky used actor-modified versions of PHProxy, an open-source web proxy written in PHP, to examine web traffic ... and to collect any credentials entered by the victim.

via cisa advisoriescisa.gov

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Reconnaissance

1 technique

T1598.003Spearphishing LinkEvidence1

Three complete phishing kits (blog/, nportal/, uinvoice/) built on a modified Glype / PHProxy v0.5b2 reverse proxy, configured to intercept Naver credentials and full session cookies in real time.

Resource Development

1 technique

T1608.005Link TargetEvidence1

The report lists MITRE ATT&CK: ... T1608.005 ...

Initial Access

1 technique

T1078Valid AccountsEvidence1

The kit captured their password and their full authenticated session cookies ... grants account access without 2FA, so from Kimsuky's side the victim can be taken over silently.

Persistence

1 technique

T1078Valid AccountsEvidence1

The kit captured their password and their full authenticated session cookies ... grants account access without 2FA, so from Kimsuky's side the victim can be taken over silently.

Privilege Escalation

1 technique

T1078Valid AccountsEvidence1

The kit captured their password and their full authenticated session cookies ... grants account access without 2FA, so from Kimsuky's side the victim can be taken over silently.

Stealth

2 techniques

T1078Valid AccountsEvidence1

The kit captured their password and their full authenticated session cookies ... grants account access without 2FA, so from Kimsuky's side the victim can be taken over silently.

T1497Virtualization/Sandbox EvasionEvidence1

The anti-analysis module ... blocks known security researcher IPs ... blocks by ISP/ASN name-match: Google, RIPE, Naver, Daum, Kakao, Microsoft, Trustwave, AVAST ... blocks the user agents bot, python, carbon, github, HeadlessChrome.

Credential Access

4 techniques

T1056Input CaptureEvidence1

TA406 uses custom credential-harvesting pages, Basic HTTP authentication and PHProxy to collect credentials.

T1056.003Web Portal CaptureEvidence1

The modifications here turn it into a credential harvester: ... Captures entered credentials via form interception on the proxied HTML.

T1539Steal Web Session CookieEvidence1

Captures full session cookies — including Naver's NID_JST authentication token ... A captured session cookie that includes NID_JST grants account access without 2FA.

T1557Adversary-in-the-MiddleEvidence2

TA406, to collect credentials, has used PHProxy, which proxies network traffic from a victim to the targeted email service.

Discovery

2 techniques

T1082System Information DiscoveryEvidence1

confirm.php Victim system profiling — logs IP, ISP, country, User-Agent, COMPUTERNAME, NUMBER_OF_PROCESSORS.

T1497Virtualization/Sandbox EvasionEvidence1

Collection

3 techniques

T1056Input CaptureEvidence1

TA406 uses custom credential-harvesting pages, Basic HTTP authentication and PHProxy to collect credentials.

T1056.003Web Portal CaptureEvidence1

The modifications here turn it into a credential harvester: ... Captures entered credentials via form interception on the proxied HTML.

T1557Adversary-in-the-MiddleEvidence2

TA406, to collect credentials, has used PHProxy, which proxies network traffic from a victim to the targeted email service.

Command and Control

1 technique

T1071.001Web ProtocolsEvidence1

Intercepts all HTTP requests and responses between the victim and the real Naver servers ... Telegram-bot callback path ... for real-time credential exfiltration alerts.

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

mitre attackNews

Mar 18, 2026

Kimsuky, Black Banshee, Velvet Chollima, Emerald Sleet, THALLIUM, APT43, TA427, Springtail, Group G0094 | MITRE ATT&CK®

A PHP-based proxy tool; in this context, modified and used to perform adversary-in-the-middle traffic inspection between victim and websites.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

PHProxy