Skip to content

Multi-hop Proxy

Subtechnique · ATTACK:enterprise:T1090.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1090.003",
  "title": "Multi-hop Proxy",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1090/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--a782ebe2-daba-42c7-bc82-e8e9d923162d",
  "external_id": "T1090.003",
  "domain": "enterprise",
  "created": "2020-03-14T23:23:41.770Z",
  "modified": "2026-05-12T15:12:00.706Z",
  "version": "2.4",
  "aliases": [

  ],
  "tactics": [
    "command-and-control"
  ],
  "source_references": [
    {
      "source_name": "ORB Mandiant",
      "url": "https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"
    },
    {
      "source_name": "NGLite Trojan",
      "url": "https://unit42.paloaltonetworks.com/manageengine-godzilla-nglite-kdcsponge/"
    },
    {
      "source_name": "Onion Routing",
      "url": "https://en.wikipedia.org/wiki/Onion_routing"
    }
  ]
}

Explicit source assertions (46)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0276 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02e4c930-ffc1-4bcb-a989-12db90671f90

synack 2016 review

ATTACK:enterprise:S0282 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e113a7f-2aba-4dc6-b4fc-4c0f0d013c3d

objsee mac malware 2017

ATTACK:enterprise:S0342 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f97d56a-3484-47fb-a232-5a20121fa89c

ESET GreyEnergy Oct 2018

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--103964f0-77c2-4a20-8026-4e3b5ec1ede0

CISA GRU29155 2024

ATTACK:enterprise:S0386 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--186ee163-fb1f-4a7d-b7d9-3c01efbb2be0

NJCCIC Ursnif Sept 2016 · ProofPoint Ursnif Aug 2016

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2148a1fd-048e-48c1-a85d-4fda2f94efbb

ATTACK:enterprise:S0438 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--278b9898-50c6-4c6d-9a35-7079ed580e78

ESET Attor Oct 2019

ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b6195a4-72f8-4d31-9824-a7c8a7018134

TrendMicro Pawn Storm Dec 2020

ATTACK:enterprise:C0004 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2b6b93eb-6664-4a70-82a9-e56a416b9e61

BlackBerry CostaRicto November 2020

ATTACK:enterprise:T1090.003 → subtechnique-of → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2c78a913-5b17-4942-a6e9-8bfa4c24149b

ATTACK:enterprise:G1045 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ccd3c21-47e3-4b44-ac5c-bff6af6cdf0f

CISA_AA25-239ASaltTyphoon_Sept2025

ATTACK:enterprise:G0100 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3bd9165f-6f5f-4c1a-bdbf-47c733d577a8

Symantec Inception Framework March 2018

ATTACK:enterprise:G0065 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c4401bf-7a45-4d1d-a4ee-ea00788cd2aa

CISA AA21-200A APT40 July 2021

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3d02f381-1402-430e-aacd-5e9350df2505

FoxIT Wocao December 2019

ATTACK:enterprise:S1087 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4318a3e0-de45-4d78-a205-527e08c51fe8

ESET MirrorFace 2025

ATTACK:enterprise:M1037 → mitigates → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4735a1be-c556-4844-9554-d2313376f09a

ATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48aaad9e-bd08-4730-bf58-2c760a113ed4

Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023

ATTACK:enterprise:G0085 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--50f68fb8-1e59-4b3a-b389-9c2797f4d347

FireEye Hacking FIN4 Dec 2014

ATTACK:enterprise:S0623 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--516c98bb-bef8-4f24-ac69-acb3b662a870

Unit 42 Siloscape Jun 2021

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54188543-7746-4158-9a9f-5556bb99ec7a

Mandiant No Easy Breach · MSTIC Nobelium Oct 2021

ATTACK:enterprise:C0052 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b95a4a8-0cd2-457c-ba38-902ad285e5aa

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6066869c-5883-457f-bf48-10f453039b94

Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024 · Check Point Medusa Ransomware April 2025 · Broadcom Medusa Ransomware Medusa Group March 2025

ATTACK:enterprise:S9001 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--67810ade-edd1-4d33-9677-b8bd8a175638

BlackBasta · SophosGnGal_SystemBC_Dec2020 · HarmonProofpoint_SystemBC_Aug2019 · TrumanKroll_SYSTEMBCServer_Jan2024

ATTACK:enterprise:C0053 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6b3adc08-6687-4b92-a0bd-b12f6eecbf2b

ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74ca2dd6-3194-42f3-bee6-6a9a59b082ab

Google Salesforce JUN 2025

ATTACK:enterprise:S1100 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8099e8d0-d8a1-407e-ba20-cfae2ae9f640

Kaspersky ToddyCat June 2022

ATTACK:enterprise:G0030 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8ec91b01-924a-491c-8b1c-ff1ec49c0ce9

Cisco LotusBlossom 2025

ATTACK:enterprise:G0128 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8f3c8b37-8437-499b-8b13-d9d6f025a5f3

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91a1d7fc-8057-4b7d-bef5-9c92612e4fe5

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:C0055 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--923ece74-d9a7-4084-ba1a-7f3633f6df54

Microsoft Storm-0940

ATTACK:enterprise:S0183 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--92e4cc06-5708-4486-92cc-0d25d9a755d4

Dingledine Tor The Second-Generation Onion Router

ATTACK:enterprise:S1107 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--944ddd08-e535-4f66-aec2-051f8b35ae80

NKAbuse BC · NKAbuse SL

ATTACK:enterprise:S1144 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f6ba73c-5cb7-44c7-8433-ab6fc8c8baca

ATTACK:enterprise:S0281 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9bf9268-1c45-4293-a5c2-c493556ad546

objsee mac malware 2017

ATTACK:enterprise:S0687 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa498c95-d53a-4ab7-96ba-26d7111d71d0

NCSC CISA Cyclops Blink Advisory February 2022

ATTACK:enterprise:S9043 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b0c535b5-f246-4bc4-980c-428a56e0bafc

Wiz Mini Shai-Hulud MAY 2026

ATTACK:enterprise:S1106 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bd95ad97-90ed-4d48-bd50-a4ac234d63ad

ATTACK:enterprise:S0491 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c1d36d2e-a8ab-4132-8690-e97628a07a0f

Bitdefender StrongPity June 2020

ATTACK:enterprise:S0604 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9fbbab5-c6f1-4aed-bf1f-ea7c83e4d1f2

Dragos Crashoverride 2017

ATTACK:enterprise:S0366 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf498579-a7c9-4d06-949b-fb75bf762990

SecureWorks WannaCry Analysis

ATTACK:enterprise:G0047 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d57d2087-dfcf-40d4-904a-27907c321545

SymantecCarbonBlack_ShuckwormUSB_Apr2025

ATTACK:enterprise:C0056 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e40578ef-e703-428e-874d-6fcee8a32d2f

Mandiant UNC3886 Juniper Routers MAR 2025

ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e415632a-d3e4-4b15-b285-4eab032989e4

FBI_SHLMS_May2026

ATTACK:enterprise:S0384 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e496b3d5-3608-49e6-9567-86b370abeeb3

Checkpoint Dridex Jan 2021

ATTACK:enterprise:S1184 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0fc42ee-9da6-4ec0-a3ff-8248889febe5

Google Cloud BOLDMOVE 2023

ATTACK:enterprise:S0641 → uses → ATTACK:enterprise:T1090.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fdc0030c-ed38-49b0-afcc-266e19aa363e

ESET Kobalos Feb 2021 · ESET Kobalos Jan 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.