LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0238: Proxysvc

Proxysvc is a malicious DLL used by Lazarus Group in a campaign known as Operation GhostSecret. It has appeared to be operating undetected since 2017 and was mostly observed in higher education organizations. The goal of Proxysvc is to deliver additional payloads to the target and to maintain control for the attacker. It is in the form of a DLL that can also be executed as a standalone process. [1]

EnterpriseS0238MalwareObject v1.3Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Proxysvc is a Windows malicious DLL associated in ATT&CK with Lazarus Group and Operation GhostSecret. Its business significance is not just the malware name: the described purpose is to deliver additional payloads and maintain attacker control, with related behaviors spanning command execution, discovery, collection, exfiltration over command-and-control, file deletion, service execution, and data destruction. That makes it relevant to incident containment, evidence preservation, egress monitoring, and resilience planning, especially where Windows systems hold sensitive research, operational, or regulated data.

Executive priority

Treat this as a validation case for whether the organization can detect and investigate a Windows DLL-based intrusion that may progress from discovery to collection, exfiltration, and potential destructive activity. Leaders should ask whether SOC and IR teams can correlate suspicious DLL/service execution, command shell use, host discovery, outbound web-based C2-like traffic, and file deletion into a single incident narrative. Because ATT&CK provides no official detection guidance for this object, priority should be on proving telemetry coverage and response readiness rather than assuming existing tools cover it.

Technical view

For SOC and IR teams, map coverage around the ATT&CK relationships: Windows Command Shell, Service Execution, Query Registry, Process Discovery, System Information Discovery, File and Directory Discovery, Local Storage Discovery, Automated Collection, Data from Local System, Web Protocols for command-and-control, Exfiltration Over C2 Channel, File Deletion, and Data Destruction. Validate that Windows endpoint logs, process lineage, service creation/execution records, registry query visibility, file-system activity, and outbound HTTP/S metadata can be correlated. Since Proxysvc is described as a DLL that can also execute as a standalone process, pay attention to unusual DLL load paths, unsigned or unexpected DLL execution patterns, abnormal parent-child process chains, and service-control activity tied to command shell execution.

Likely telemetry

  • Windows process creation and command-line telemetry
  • DLL load/module telemetry where available
  • Windows service creation, modification, and execution events
  • Registry access/query telemetry
  • File and directory enumeration, collection, deletion, and destruction-related file activity

Detection direction

  • Build behavior-based detections around chains of activity rather than the malware name alone: service execution or unusual DLL execution followed by command shell use, discovery commands, file enumeration, and outbound web traffic.
  • Tune for false positives from legitimate administration tools, software deployment, backup agents, inventory scanners, and service management activity by requiring suspicious parent process, execution path, user context, destination, or timing context.
  • Validate that web protocol monitoring can distinguish normal business HTTP/S traffic from unusual beaconing, rare destinations, or host-to-external communications following discovery or collection activity.
  • Correlate file deletion with prior tool execution or collection activity to support evidence-preservation decisions during IR.
  • Use the Lazarus Group relationship as threat-intelligence context for prioritization, but do not rely on attribution as a detection condition.

Mitigation priorities

  • Prioritize Windows endpoint hardening and monitoring for DLL execution, service abuse, command shell use, and registry/system discovery activity.
  • Restrict unnecessary administrative privileges and service-control capabilities to reduce opportunities for service-based execution.
  • Maintain outbound network controls and logging for HTTP/S egress so potential C2 and exfiltration paths are visible and reviewable.
  • Ensure backups, recovery procedures, and destructive-activity response playbooks are tested because related behaviors include Data Destruction.
  • Prepare IR procedures for rapid host isolation, volatile evidence capture, and preservation of service, process, registry, file, and network artifacts.
Additional notes and limits

The supplied ATT&CK object identifies Proxysvc as a Windows malicious DLL used by Lazarus Group in Operation GhostSecret, mostly observed in higher education organizations, with a purpose of delivering additional payloads and maintaining attacker control. The relationship set gives useful behavioral coverage even though the malware object itself has no listed tactics and no official detection text.

No official ATT&CK detection guidance, aliases, labels, or malware-specific indicators were provided. The related ATT&CK techniques include broad platform lists, but the Proxysvc object platform is Windows, so environment-specific validation should focus on Windows unless separate evidence supports other platforms. This take does not assert current activity, customer exposure, guaranteed detection, or confirmed impact beyond the supplied fields.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Proxysvc

Proxysvc is a malicious DLL used by Lazarus Group in a campaign known as Operation GhostSecret. It has appeared to be operating undetected since 2017 and was mostly observed in higher education organizations. The goal of Proxysvc is to deliver additional payloads to the target and to maintain control for the attacker. It is in the form of a DLL that can also be executed as a standalone process. [1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

15 rows
DomainIDNameRelationship / procedure
EnterpriseT1005Data from Local System

Proxysvc searches the local system and gathers data.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

Proxysvc uses HTTP over SSL to communicate commands with the control server.[1]

EnterpriseT1070.004File DeletionSub-technique

Proxysvc can delete files indicated by the attacker and remove itself from disk using a batch file.[1]

EnterpriseT1119Automated Collection

Proxysvc automatically collects data about the victim and sends it to the control server.[1]

EnterpriseT1569.002Service ExecutionSub-technique

Proxysvc registers itself as a service on the victim’s machine to run as a standalone process.[1]

EnterpriseT1680Local Storage Discovery

Proxysvc collects volume information for all drives on the system.[1]

EnterpriseT1083File and Directory Discovery

Proxysvc lists files in directories.[1]

EnterpriseT1082System Information Discovery

Proxysvc collects the OS version, country name, MAC address, computer name, and physical memory statistics.[1]

EnterpriseT1057Process Discovery

Proxysvc lists processes running on the system.[1]

EnterpriseT1041Exfiltration Over C2 Channel

Proxysvc performs data exfiltration over the control server channel using a custom protocol.[1]

EnterpriseT1012Query Registry

Proxysvc gathers product names from the Registry key: HKLM\Software\Microsoft\Windows NT\CurrentVersion ProductName and the processor description from the Registry key HKLM\HARDWARE\DESCRIPTION\System\CentralProcessor\0 ProcessorNameString.[1]

EnterpriseT1016System Network Configuration Discovery

Proxysvc collects the network adapter information and domain/username information based on current remote sessions.[1]

EnterpriseT1124System Time Discovery

As part of the data reconnaissance phase, Proxysvc grabs the system time to send back to the control server.[1]

EnterpriseT1059.003Windows Command ShellSub-technique

Proxysvc executes a binary on the system and logs the results into a temp file by using: cmd.exe /c " > %temp%\PM* .tmp 2>&1".[1]

EnterpriseT1485Data Destruction

Proxysvc can overwrite files indicated by the attacker before deleting them.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0032: Lazarus Group

Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]

North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1005: Data from Local SystemEnterpriseuses · GroupG0032: Lazarus GroupEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1119: Automated CollectionEnterpriseuses · TechniqueT1569.002: Service ExecutionEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1041: Exfiltration Over C2 ChannelEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1485: Data DestructionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.3
Created
Modified
Raw hash
e5c6763fbfd91808...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.3Current bundlee5c6763fbfd9…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  2. [2]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  3. [3]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  4. [4]
    Proxysvc

    (Citation: McAfee GhostSecret)

  5. [5]
    Proxysvc

    (Citation: McAfee GhostSecret)

  6. [6]
    Proxysvc

    (Citation: McAfee GhostSecret)

  7. [7]
    mitre-attackS0238
    Open source URL
  8. [8]
    mitre-attackS0238
    Open source URL
  9. [9]
    mitre-attackS0238
    Open source URL
  10. [10]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  11. [11]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  12. [12]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  13. [13]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  14. [14]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  15. [15]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  16. [16]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  17. [17]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  18. [18]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  19. [19]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  20. [20]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  21. [21]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  22. [22]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  23. [23]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  24. [24]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  25. [25]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  26. [26]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  27. [27]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  28. [28]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  29. [29]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  30. [30]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  31. [31]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  32. [32]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  33. [33]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  34. [34]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  35. [35]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  36. [36]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  37. [37]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  38. [38]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
  39. [39]
    McAfee GhostSecret

    Sherstobitoff, R., Malhotra, A. (2018, April 24). Analyzing Operation GhostSecret: Attack Seeks to Steal Data Worldwide. Retrieved May 16, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use