S1144 FRP

toolEnterprise

platformsLinux · macOS · Windows

also known asFRP

FRP, which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT) to the Internet. FRP can support multiple protocols including TCP, UDP, and HTTP(S) and has been abused by threat actors to proxy command and control communications.

techniques used (10)

ATT&CK techniques this enables or maps to.

T1046Network Service Discovery
T1049System Network Connections Discovery
T1059.007JavaScript
T1071.001Web Protocols
T1090Proxy
T1090.003Multi-hop Proxy
T1095Non-Application Layer Protocol
T1572Protocol Tunneling
T1573.001Symmetric Cryptography
T1573.002Asymmetric Cryptography

used by groups (3)

Threat groups associated with this.

G0108Blue Mockingbird
G0059Magic Hound
G1017Volt Typhoon

used by campaigns (3)

Campaigns that use this.

C00573CX Supply Chain Attack
C0043Indian Critical Infrastructure Intrusions
C0060Operation AkaiRyū

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan