Attackers use Proxy Through Victim to route their traffic through a compromised device or account so their activity appears to come from the victim. This can hide the true source, evade geofencing, and support fraud or abuse. Defenders should look for unusual relaying behaviour, unexpected outbound connections, and account or device sessions used as intermediaries.
Why Proxy Through Victim Works for Attackers
proxy through victim is attractive because it turns the victim into the apparent origin of activity. That changes how logs, geo checks, rate limits and fraud models interpret the event, especially when the attacker only needs the victim to stay online long enough to relay traffic. The technique is most useful when the attacker wants to blend in rather than break in loudly.
It also works across several abuse cases, not just one type of compromise. A compromised account can proxy application requests, while a compromised device can forward network traffic, making the relay look like normal user or host behaviour. In practice, that means the attacker is borrowing the victim’s trust boundary instead of creating a new one.
When the relay sits inside a compromised account or machine, the attacker often relies on normal session state, existing network reachability and accepted trust relationships. That is why this pattern can evade location-based controls, hide the true source of requests and keep malicious activity inside what defenders initially consider legitimate traffic.
What Defenders Should Look For
Defenders should focus on indicators that the victim is being used as an intermediary, not just as a compromised endpoint. Unusual outbound connections, repeated relays to unfamiliar destinations, and sessions that act as a bridge between otherwise unrelated services are common signs. Behavioral baselines matter here because the same device or account may look normal in isolation while still being abused as a proxy.
Telemetry should also be reviewed for access patterns that do not fit the victim’s normal role. That includes requests that appear to originate from one user or device but consistently reach multiple unrelated targets, changes in source geography that do not align with the victim’s travel or infrastructure, and concurrent use patterns that suggest one session is being used to forward another.
Detection is stronger when network, identity and endpoint views are correlated. A proxy-through-victim event often becomes visible only when an expected user session is paired with unexpected network relay behaviour or when a device shows outbound flows that do not match its usual application footprint.
How to Contain and Remove the Relay Path
Containment should prioritise breaking the attacker’s relay path before assuming the victim is “just” compromised. If the victim is an account, revoke active sessions, invalidate tokens where appropriate and reset the credential material that could keep the relay alive. If the victim is a device, isolate it quickly enough to stop forwarding, but preserve evidence so the relay chain can still be reconstructed.
Where the abuse is tied to access from a particular region, service or network zone, tighten the control at the boundary that the attacker is abusing rather than only hardening the victim itself. CISA cyber threat advisories are useful for aligning response with current exploitation patterns, while the victim-side evidence should drive your internal containment choice.
If the relay depends on account-level access, review whether permissions were broader than needed and whether the session was allowed to reach systems it should never have touched. If the abuse depends on a machine acting as a hop, confirm whether the host had the network paths, local tooling or cached access that made relaying possible in the first place.
Risk and Threat Considerations
Proxy Through Victim raises both visibility and trust risks because the defender sees legitimate infrastructure or credentials being used for illegitimate routing. That can delay detection, distort attribution and let fraud or abuse pass through controls that depend on source reputation, location or known-session behaviour.
Failure mechanism: The attacker compromises a device or account, then uses its trusted network position, session state or reachability to forward traffic so the malicious activity inherits the victim’s apparent identity and location.
Impact: This can bypass geofencing, complicate incident triage, and increase the chance that later abuse is treated as routine user or host activity rather than an active compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1090 — Proxy | Proxy Through Victim is an access-relay pattern used to route activity through a trusted intermediary. |
| Recommendation — Map relay activity to proxy tradecraft and hunt for intermediary hosts or sessions used to forward traffic. | ||
| NIST SP 800-53 Rev 5 | AU-6 — Audit Record Review, Analysis, and Reporting | Victim-relay abuse is often detected through abnormal logs, source changes, and session correlation. |
| IA-5 — Authenticator Management | Compromised accounts used as proxies often require credential or token revocation to stop reuse. | |
| AC-6 — Least Privilege | Overbroad access lets a compromised victim reach more destinations and relay more abuse. | |
| Recommendation — Review and correlate audit records to spot relayed traffic and inconsistent source behaviour. Revoke or rotate compromised authenticators and invalidate sessions used to relay traffic. Restrict victim permissions so a compromised session cannot access unnecessary systems. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find anomalous activity | Relay abuse is exposed by unusual outbound connections and abnormal network paths. |
| Recommendation — Monitor network flows for relay-like patterns and unusual intermediary connections. | ||
Practitioner Guidance
What to verify: Confirm whether the suspected victim has acted as a relay, not just whether it has been accessed. Check for destination sets, timing patterns and session concurrency that do not match the victim’s normal behaviour.
What to prioritise: Break the relay first, then investigate the original compromise path. If you only remove the observed malicious request and leave the victim session alive, the attacker may keep using the same intermediary.
Common mistake: Treating geolocation or source IP alone as proof of legitimacy. When a victim is being proxied through, those signals may be the attacker’s disguise rather than evidence of trust.
Practitioner takeaway: The key question is not only “who is logged in”, but “which trusted path is being abused to move traffic.” Once a victim becomes an intermediary, containment must target the relay mechanism as well as the initial compromise.