S1144: FRP
FRP, which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT) to the Internet. FRP can support multiple protocols including TCP, UDP, and HTTP(S) and has been abused by threat actors to proxy command and control communications.[1][2][3][4]
Security context for executives and security teams
FRP is a legitimate open-source reverse proxy tool that can expose systems behind firewalls or NAT to the Internet. That makes it operationally useful, but also material for defenders: if introduced without authorization, it can create covert access paths, proxy command-and-control traffic, and weaken assumptions that perimeter controls are blocking inbound reachability.
Executive priority
Treat unauthorized FRP presence as a high-value investigation lead, especially in environments where business continuity depends on segmentation, controlled remote access, or critical infrastructure resilience. Leaders should ask whether the organization can prove which hosts are allowed to run tunneling/proxy software, whether egress controls would reveal unexpected TCP, UDP, HTTP, or HTTPS proxying, and whether incident responders can quickly determine what internal services may have been exposed through a tunnel.
Technical view
FRP is listed for Linux, macOS, and Windows. ATT&CK does not provide official detection guidance for this tool, so SOC and IR teams should validate coverage around the related behaviors: proxying and multi-hop proxy use, protocol tunneling, web-protocol C2, non-application-layer communications such as UDP, encrypted C2, and network/service discovery. Relationship context also links FRP to Network Service Discovery, System Network Connections Discovery, JavaScript execution, and multiple command-and-control techniques, so investigations should combine host process evidence with network flow and egress analysis rather than relying on a single filename or indicator.
Likely telemetry
- Endpoint process execution and command-line history on Linux, macOS, and Windows hosts
- File creation and persistence-related evidence for newly introduced proxy/tunneling binaries or configuration files
- Network connection records showing unusual outbound TCP, UDP, HTTP, or HTTPS sessions
- Proxy, firewall, DNS, and web gateway logs that can show unexpected egress destinations or long-lived connections
- NetFlow or equivalent metadata for persistent tunnels, unusual ports, or systems communicating outside their normal role
Detection direction
- Build detections around unauthorized reverse proxy or tunneling behavior, not only the FRP name, because legitimate tools can be renamed or staged in unusual paths.
- Baseline approved remote-access, proxy, and tunneling tools; alert when servers or workstations without a business need initiate persistent external connections.
- Correlate endpoint execution with egress telemetry. A process that starts shortly before new long-lived outbound HTTP(S), TCP, or UDP sessions is stronger than network evidence alone.
- Tune for false positives from sanctioned developer, infrastructure, or remote administration use of reverse proxies; require asset owner validation and documented approval.
- Hunt for relationship-driven context: discovery activity before or after FRP execution, proxy chaining patterns, tunneled access to internal services, and encrypted traffic that bypasses normal application paths.
Mitigation priorities
- Maintain an allowlist or approval process for reverse proxy, tunneling, and remote-access utilities on servers and workstations.
- Restrict outbound connectivity by role so hosts cannot freely establish external TCP, UDP, HTTP, or HTTPS tunnels without business justification.
- Monitor and review egress paths, especially from sensitive segments, critical systems, and hosts that should not initiate Internet-facing proxy connections.
- Ensure asset owners document legitimate FRP or similar tool deployments, including purpose, destination, protocol, and expected runtime behavior.
- During incident response, isolate suspected hosts as appropriate, preserve process and network evidence, identify exposed internal services, and review adjacent discovery and command-and-control activity.
Additional notes and limits
ATT&CK identifies FRP as an openly available Fast Reverse Proxy tool and records that it has been abused to proxy command-and-control communications. Relationship context lists use by several campaigns and groups, including Indian Critical Infrastructure Intrusions, 3CX Supply Chain Attack, Operation AkaiRyū, Magic Hound, Blue Mockingbird, and Volt Typhoon, and maps the tool to discovery, execution, proxy, tunneling, web protocol, non-application-layer protocol, and cryptographic C2 techniques. Use these relationships as prioritization context, not as proof of a specific actor in a local incident.
The supplied object has no official ATT&CK detection text, no aliases, and no explicit tactics on the tool object itself. Detection and mitigation recommendations therefore rely on the official description, supported platforms, external references, and ATT&CK relationships. Local confirmation is required to distinguish authorized FRP use from suspicious use and to determine actual exposure or impact.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
FRP
FRP, which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT) to the Internet. FRP can support multiple protocols including TCP, UDP, and HTTP(S) and has been abused by threat actors to proxy command and control communications.[1][2][3][4]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1095 | Non-Application Layer Protocol | |
| Enterprise | T1059.007 | JavaScriptSub-technique | |
| Enterprise | T1090 | Proxy | |
| Enterprise | T1572 | Protocol Tunneling | |
| Enterprise | T1573.002 | Asymmetric CryptographySub-technique | |
| Enterprise | T1046 | Network Service Discovery | |
| Enterprise | T1049 | System Network Connections Discovery | |
| Enterprise | T1090.003 | Multi-hop ProxySub-technique | |
| Enterprise | T1573.001 | Symmetric CryptographySub-technique | |
| Enterprise | T1071.001 | Web ProtocolsSub-technique |
Groups, software, and campaigns
G0108: Blue Mockingbird
Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.[1]
G0059: Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]
G1017: Volt Typhoon
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].
Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]
C0043: Indian Critical Infrastructure Intrusions
Indian Critical Infrastructure Intrusions is a sequence of intrusions from 2021 through early 2022 linked to People’s Republic of China (PRC) threat actors, particularly RedEcho and Threat Activity Group 38 (TAG38). The intrusions appear focused on IT system breach in Indian electric utility entities and logistics firms, as well as potentially managed service providers operating within India. Although focused on OT-operating entities, there is no evidence this campaign was able to progress beyond IT breach and information gathering to OT environment access.[1][2]
C0057: 3CX Supply Chain Attack
The 3CX Supply Chain Attack was the first publicly reported case of one supply chain compromise triggering another, leading to a cascading, two-stage intrusion. The initial supply chain attack began when a 3CX employee downloaded and executed a trojanized, end-of-life version of the X_Trader trading software from Trading Technologies. This provided UNC4736, a threat cluster associated with AppleJeus, access to the 3CX environment. From there UNC4736 compromised the Windows and macOS build environments used to distribute the 3CX desktop application to their customers.[1] While 3CX serves more than 600,000 customers and 12 million users, only a subset of systems were affected. Subsequent targeting focused on victims in the defense and cryptocurrency sectors, where attackers deployed secondary payloads such as Gopuram for credential theft and persistence.[2] The campaign began in late 2022 and was disrupted after security vendors publicly reported the compromise in March 2023.[3][4]
C0060: Operation AkaiRyū
Operation AkaiRyū (Japanese for RedDragon) was a cyberespionage spearphishing campaign conducted by MirrorFace between June and September 2024 against entities in Japan and Central Europe. Operation AkaiRyū notably included the first reported targeting of a European entity by MirrorFace, as well as their use of UPPERCUT, which was thought to be exclusive to menuPass.[1][2]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 0ecefc26889f… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [2]Joint Cybersecurity Advisory Volt Typhoon June 2023
NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.
Open source URL - [3]RedCanary Mockingbird May 2020
Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.
Open source URL - [4]DFIR Phosphorus November 2021
DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.
Open source URL - [5]RecordedFuture RedEcho 2022
Recorded Future Insikt Group. (2022, April 6). Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group. Retrieved November 21, 2024.
Open source URL - [6]Mandiant 3cx UNC4736 2023
Jeff Johnson, Fred Plan, Adrian Sanchez, Renato Fontana, Jake Nicastro, Dimiter Andonov, Marius Fodoreanu, Daniel Scott. (2023, April 20). 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible. Retrieved August 25, 2025.
Open source URL - [7]Microsoft Volt Typhoon May 2023
Microsoft Threat Intelligence. (2023, May 24). Volt Typhoon targets US critical infrastructure with living-off-the-land techniques. Retrieved July 27, 2023.
Open source URL - [8]ESET MirrorFace 2025
Dominik Breitenbacher. (2025, March 18). Operation AkaiRyū: MirrorFace invites Europe to Expo 2025 and revives ANEL backdoor. Retrieved May 22, 2025.
Open source URL - [9]DFIR Phosphorus November 2021
DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.
Open source URL - [10]DFIR Phosphorus November 2021
DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.
Open source URL - [11]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [12]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [13]Joint Cybersecurity Advisory Volt Typhoon June 2023
NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.
Open source URL - [14]Joint Cybersecurity Advisory Volt Typhoon June 2023
NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.
Open source URL - [15]RedCanary Mockingbird May 2020
Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.
Open source URL - [16]RedCanary Mockingbird May 2020
Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.
Open source URL - [17]mitre-attackS1144Open source URL
- [18]mitre-attackS1144Open source URL
- [19]mitre-attackS1144Open source URL
- [20]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [21]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [22]RedCanary Mockingbird May 2020
Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.
Open source URL - [23]RedCanary Mockingbird May 2020
Lambert, T. (2020, May 7). Introducing Blue Mockingbird. Retrieved May 26, 2020.
Open source URL - [24]RecordedFuture RedEcho 2022
Recorded Future Insikt Group. (2022, April 6). Continued Targeting of Indian Power Grid Assets by Chinese State-Sponsored Activity Group. Retrieved November 21, 2024.
Open source URL - [25]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [26]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [27]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [28]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [29]DFIR Phosphorus November 2021
DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.
Open source URL - [30]DFIR Phosphorus November 2021
DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.
Open source URL - [31]Mandiant 3cx UNC4736 2023
Jeff Johnson, Fred Plan, Adrian Sanchez, Renato Fontana, Jake Nicastro, Dimiter Andonov, Marius Fodoreanu, Daniel Scott. (2023, April 20). 3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible. Retrieved August 25, 2025.
Open source URL - [32]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [33]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [34]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [35]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [36]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [37]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [38]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [39]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [40]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [41]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [42]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [43]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL - [44]Joint Cybersecurity Advisory Volt Typhoon June 2023
NSA et al. (2023, May 24). People's Republic of China State-Sponsored Cyber Actor Living off the Land to Evade Detection. Retrieved July 27, 2023.
Open source URL - [45]FRP GitHub
fatedier. (n.d.). What is frp?. Retrieved July 10, 2024.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.