What Is Relay Malware? Definition & Examples

Relay malware is malicious code that turns a host into a forwarding node for attacker-controlled traffic rather than only stealing data or executing commands locally. The relay can sit in front of services, proxies, or tunnels, giving the attacker a reusable transport layer that is harder to distinguish from legitimate network behaviour.

What Relay Malware Actually Does

Relay malware is not just a local payload that steals files or runs commands, it turns an infected host into a traffic relay. That makes the host a transport node that can forward attacker traffic through ordinary network paths, which can blur the line between malicious activity and legitimate proxying.

That distinction matters because the malware’s value is often persistence and reach, not immediate destruction. By brokering connections, it can help attackers reuse infrastructure, keep sessions alive, or route around direct exposure of their own tooling.

Why Relay Malware Is Operationally Useful to Attackers

A relay gives an attacker a reusable path into services, tunnels, or proxies without having to connect directly from a known hostile source. This can support staged access, pivoting, credential use, or covert traffic shaping, especially when the relay sits inside an environment that already expects proxy-like communication.

Relay behaviour also changes the defender’s problem. The suspicious component may look like ordinary forwarding, and the real malicious objective may be several hops away from the compromised host. A related pattern appears in CircleCI breach 2023, where malware-assisted access to a trusted environment enabled theft of valuable secrets and keys.

How Relay Malware Blends Into Network Paths

Relay malware typically operates by accepting inbound or local traffic and forwarding it to attacker-chosen destinations. Depending on the design, it may function like a proxy, tunnel endpoint, port forwarder, or relay chain, making the compromised host part of the communication path rather than the destination itself.

This is what makes detection difficult: network telemetry may show valid protocols, expected ports, and ordinary-looking destinations, while the malicious significance lies in the forwarding relationship. In supply-chain style abuse, Shai Hulud npm malware campaign shows how malware can turn ordinary software distribution and CI/CD touchpoints into a channel for attacker access and secret exposure.

Security Implications of Relay Behaviour

Relay malware increases the trust gap between observed source and true origin. It can obscure attribution, complicate containment, and create lateral movement opportunities when internal systems accept the relay as a legitimate intermediary.

It is also risky because relays often touch authentication material, session traffic, or sensitive service traffic. Once the host is trusted as a forwarding point, the attacker may gain durable access to channels that are harder to isolate than a simple endpoint infection.

Risk and Threat Considerations

Relay malware is dangerous because it can make a compromised machine part of the attacker’s transport layer, not just an infected endpoint. That raises the chance of hidden pivoting, traffic interception, and abuse of trusted network paths, especially where proxying or tunnelling is already normal.

Failure mechanism: The host forwards attacker-controlled traffic through a path that defenders may treat as routine, which helps the attacker preserve access and conceal the real origin of activity.

Impact: The result can be stealthier lateral movement, harder attribution, broader exposure of internal services, and more difficult containment once the relay becomes embedded in operational traffic.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK and OWASP Non-Human Identity Top 10 address the attack and risk surface, while CIS Controls v8, NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-8 — Audit Log Management	Relay malware hides in network paths, so logging and monitoring are central to spotting forwarding abuse.
Recommendation — Monitor endpoint and network logs for unexpected proxying, tunneling, and anomalous traffic relays.
NIST SP 800-53 Rev 5	SC-7 — Boundary Protection	Relay malware exploits trust boundaries by forwarding traffic through compromised hosts.
Recommendation — Restrict and inspect traffic flows across boundaries to prevent unauthorized relay paths.
MITRE ATT&CK	T1090 — Proxy	Relay malware is a proxy-like technique that forwards attacker traffic through an intermediate host.
Recommendation — Map proxy-like relays to T1090 and hunt for unexpected intermediary forwarding behavior.
NIST CSF 2.0	DE.CM-01 — Networks and network services are monitored to detect potential cybersecurity events	Relay malware is often detected through abnormal network service behavior and forwarding patterns.
Recommendation — Continuously monitor for anomalous relay, proxy, and tunnel activity on endpoints and servers.
OWASP Non-Human Identity Top 10	NHI-05 — Overprivileged NHI	Relay malware often abuses highly trusted service credentials or transport paths once a host is repurposed.
Recommendation — Reduce excessive privileges that would let compromised services become durable relay nodes.

Practitioner Guidance

What to watch for: Treat unexpected forwarding, local tunnels, unusual proxy listeners, and encrypted outbound flows from endpoints or servers as investigation signals, especially when they appear on assets that should not broker traffic. Normal-looking protocols are not enough evidence of legitimacy if the host’s role has changed.

Practitioner takeaway: The key question is not only what the malware does locally, but whether the host has been converted into part of the attacker’s communication path.

Relay Malware