T1090.003

Proxy: Multi-hop Proxy

discovered 2026-06-03

C2 and exfiltration routed through Tor (local SOCKS-style transport on 127.0.0.1, external TCP/80 and TCP/8080) to a .onion service.

View on MITRE ATT&CK

Seen in packages

Campaigns