Technique:  Proxy
It used a tool called CLASSFON to covertly proxy network communications.
Aria-body has the ability to use a reverse SOCKS proxy module.
AuditCred can utilize proxy for communications.
BADCALL functions as a proxy server between the victim and C2 server.
BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.
Bisonal has supported use of a proxy server.
It has used frp, ssf, and Venom to establish SOCKS proxy connections.
During C0017, It used the Cloudflare CDN to proxy C2 traffic.
During C0027, It installed the open-source rsocx reverse proxy tool on a targeted ESXi appliance.
Cardinal RAT can act as a reverse proxy.
It has used the AirVPN service for operational activity.
Dridex contains a backconnect module for tunneling network traffic through a victim's computer. Infected computers become part of a P2P botnet that can relay C2 traffic to other infected peers.
It adopted Cloudflare as a proxy for compromised servers.
It has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.
FunnyDream can identify and use configured proxies in a compromised network for C2 communication.
Green Lambert can use proxies for C2 traffic.
HARDRAIN uses the command cmd.exe /c netsh firewall add portopening TCP 443 "adp" and makes the victim machine function as a proxy server.
HOPLIGHT has multiple proxy options that mask traffic between the malware and the remote operators.
HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure.
jRAT can serve as a SOCKS proxy server.
Kessel can use a proxy during exfiltration if set in the configuration.
KEYPLUG has used Cloudflare CDN associated infrastructure to redirect C2 communications to malicious domains.
KOCTOPUS has deployed a modified version of Invoke-Ngrok to expose open local ports to the Internet.
It has leverage NordVPN for its egress points when targeting intended victims.
It has used Fast Reverse Proxy (FRP) for RDP traffic.
It has used a reverse proxy tool similar to the GitHub repository revsocks.
netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.
NETWIRE can implement use of proxies to pivot traffic.
ngrok can be used to proxy connections to machines located behind NAT or firewalls.
For Operation Sharpshooter, the threat actors used the ExpressVPN service to hide their location.
During Operation Wocao, threat actors used a custom proxy tool called "Agent" which has support for multiple hops.
PLEAD has the ability to proxy network communications.
It has used the AirVPN service for operational activity.
PoshC2 contains modules that allow for use of proxies in command and control.
QuasarRAT can communicate over a reverse proxy using SOCKS5.
RainyDay can use proxy tools including boost_proxy_client for reverse proxy functionality.
Remcos uses the infected hosts as SOCKS5 proxies to allow for tunneling and proxying.
It's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.
SDBbot has the ability to use port forwarding to establish a proxy between a target host and C2.
Socksbot can start SOCKS proxy threads.
SombRAT has the ability to use an embedded SOCKS proxy in C2 communications.
TSCookie has the ability to proxy communications with command and control (C2) servers.
It RPC backdoors have included local UPnP RPC proxies.
A TYPEFRAME variant can force the compromised system to function as a proxy server.
Ursnif has used a peer-to-peer (P2P) network for C2.
Vasport is capable of tunneling though a proxy.
It has used compromised devices and customized versions of open source tools  such as Fast Reverse Proxy (FRP), Earthworm, and Impacket to proxy network traffic.
WarzoneRAT has the capability to act as a reverse proxy.
It has delivered a generic Windows proxy Win32/Glubteta.M. It has also used multiple reverse proxy chains as part of their C2 infrastructure.
XTunnel relays traffic between a C2 server and a victim.
ZxShell can set up an HTTP or SOCKS proxy.