A covert relay is a compromised device that forwards attacker traffic so the true source is harder to identify. The relay may still function normally for legitimate tasks, which makes detection difficult unless teams inspect traffic patterns, exposure paths, and administrative control boundaries.
What a Covert Relay Is in Practice
A covert relay is less about a special malware family than about a compromised node being used as an intermediary. The important idea is that the attacker’s real source is obscured while the relay continues to look like an ordinary device.
That duality is what makes the concept operationally important. A relay can still process normal business traffic, so defenders may need to distinguish legitimate use from hidden forwarding behavior rather than assume the system is obviously “broken.”
How a Covert Relay Hides the True Source
The relay sits between the attacker and the eventual target, forwarding traffic or commands so the visible connection terminates on the compromised device instead of the attacker’s own infrastructure. This can be as simple as traffic redirection, or it can involve a chain of hops that makes tracing harder.
The concealment works because many environments trust internal east-west traffic, remote administration paths, or familiar network boundaries. If a device is already approved for normal work, its relayed traffic may blend in unless teams inspect routing, session origin, and timing patterns closely.
For defenders, the key question is not only “what did the device do?” but also “what did it pass through on behalf of someone else?” That distinction matters when investigating command-and-control, lateral movement, or suspicious admin activity.
Why Covert Relays Are Hard to Detect
Detection is difficult because the relay may not trigger the same alerts as a clearly malicious endpoint. The system can remain available, may still serve legitimate users, and can even look healthy at the host level while silently enabling abuse at the traffic level.
Covert relays are especially problematic when visibility is fragmented across network, host, and admin layers. If teams only monitor logs on the compromised system, they may miss the upstream origin, downstream destination, or the control boundary that was crossed to enable the relay.
Useful detection often depends on correlation: unusual connection patterns, unexpected forwarding behavior, anomalous session timing, or administrative paths that do not fit normal operations. In practice, the relay is often exposed by relationships between events, not by one obvious indicator.
Where Covert Relays Fit in Security Operations
Security teams usually treat a covert relay as a sign of compromise, not as a standalone curiosity. Once a device is being used this way, the question becomes whether the attacker also has persistence, lateral movement opportunities, or broader access hidden behind that forwarding path.
Response is usually broader than removing one malicious rule or process. Teams often need to review trust relationships, remote access paths, device ownership, and administrative boundaries to understand whether the relay was an isolated misuse or part of a wider intrusion path.
A practical example is a workstation, appliance, or server that still performs its intended role while quietly relaying attacker traffic to another target. That overlap between normal function and malicious forwarding is what makes covert relays an operationally deceptive threat pattern.
Risk and Threat Considerations
Covert relays matter because they let an attacker hide origin, preserve access, and use a trusted system as cover for further activity. The result is often delayed detection, weaker attribution, and a larger blast radius if the relay sits on a privileged or well-connected segment.
Failure mechanism: The compromised node forwards traffic across a trust boundary, so defenders see a legitimate intermediary rather than the attacker’s true source. That can mask command-and-control, lateral movement, or hands-on-keyboard activity until the relay is correlated with other anomalies.
Impact: Investigation time increases, containment becomes harder, and the compromised device can become a pivot point for deeper access. In environments with broad internal trust, a covert relay can turn one foothold into a much more resilient intrusion path.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1090 — Proxy | Covert relays function as intermediary routing and source obfuscation. |
| T1219 — Remote Access Software | Relays often preserve interactive access while concealing the operator's source. | |
| Recommendation — Map relay behavior to proxy techniques and hunt for unusual forwarding paths. Review remote access pathways for hidden operator presence and misuse. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitor Networks and Network Services | Detecting covert relays depends on continuous network-flow and service monitoring. |
| Recommendation — Instrument network monitoring to spot unexpected forwarding and source masking. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Relay activity is often revealed by correlating logs across boundaries. |
| SC-7 — Boundary Protection | A covert relay abuses trust boundaries and inter-zone traffic paths. | |
| SI-4 — System Monitoring | Relays can remain operational while silently enabling adversary traffic. | |
| Recommendation — Correlate audit records to expose anomalous forwarding and origin changes. Enforce boundary protections to constrain unauthorized traffic transit. Monitor system behavior for abnormal routing and persistence indicators. | ||
Practitioner Guidance
What to watch for: Focus on traffic that looks structurally normal but is operationally unusual, such as unexpected forwarding, odd session origin, or a device that acts as both a legitimate service point and a hidden transit path. The main mistake is to rely on host health alone and miss the network role the device is performing.
Practitioner takeaway: Treat relaying behavior as a trust-boundary problem, not just a malware problem, because the security issue is often the abuse of an otherwise ordinary system.
Related resources from NHI Mgmt Group
- What are the signs that a covert relay network is expanding through targeted micro-intrusion campaigns?
- What are the signs that a package-installed relay is being used for covert access?
- How should security teams reduce NTLM relay risk in Active Directory?
- When should organisations prioritise relay and coercion controls?