Loading malware…
RevSocket is a Go-based reverse SOCKS proxy used to turn compromised Windows computers into network relay points. It establishes an outbound WebSocket connection over TLS to a hardcoded command-and-control server and uses yamux to multiplex tunneled TCP sessions. This reverse-tunneling architecture enables operators to route traffic through victim systems and access resources within their networks.
RevSocket has been deployed through PowerShell scripts in corporate intrusions involving Microsoft Teams voice phishing and Microsoft Quick Assist. Attackers impersonate IT support personnel and persuade employees to approve remote-control sessions, then deploy malware on the compromised workstation. RevSocket appears alongside tools including GoGRPC, BlindDoor, PyGRPC, S3Siphon, and RSOX, providing network proxying rather than the command-execution or file-theft functionality of other components. Its role is post-compromise network access and support for further activity inside victim environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
After two or three months of hibernation, the reverse tunneling tool revsocket is activated to log in to the intranet platform to take off internal data.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
ThreatLabz analyzed the functionality of these tools along with the command-and-control (C2) communication methods used by the attackers.
These tools provide capabilities ranging from remote command execution and network tunneling to data theft
RevSocket : proxy SOCKS inverse en Go ... PyGRPC : proxy SOCKS inverse en Python ... RSOX : ... proxy SOCKS relay
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Reverse SOCKS proxy written in Go using WebSocket over TLS with yamux multiplexing for post-compromise network pivoting.
Supporting proxy tool that routes network activity through compromised computers, potentially enabling access to other systems or concealing the origin of attacker traffic.
A tool used in the same campaign, associated with remote command execution or network tunneling.
Additional malware used in the same campaigns alongside GoGRPC.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.