How do attackers use Multi-hop Proxy?

Attackers use Multi-hop Proxy to relay traffic through several systems so the real source is harder to trace. This helps conceal command-and-control, data theft and access from defenders. Monitor for unusual proxy chains, repeated pivot hosts, mismatched geographies and traffic patterns that do not fit normal user or application routes.

How multi-hop proxying changes attacker tradecraft

Multi-hop proxying is not just “hiding behind a proxy.” It is a routing pattern that adds layers between the attacker and the destination, which makes source attribution, traffic correlation and blocklisting harder. The practical effect is delay and ambiguity for defenders, especially when the chain is built from ordinary infrastructure rather than obviously malicious relays.

That matters because proxy chains are often part of the access path, not just the exfiltration path. When defenders see traffic that bounces across several hosts, the key question is whether those hops are acting as a simple privacy layer, a compromised relay chain, or a deliberate command-and-control path designed to blend into normal remote access behaviour.

What defenders should look for in a multi-hop chain

Multi-hop proxying usually leaves behavioural clues even when the destination is hidden. Common indicators include repeated pivot hosts, unusually long or inconsistent route patterns, sessions that change geography without a business reason, and traffic timing that does not match the normal user or application profile. A proxy chain that repeatedly reuses the same intermediate systems can also expose a stable infrastructure pattern behind the obfuscation.

For defenders, the most useful test is whether the chain fits a legitimate remote access, CDN, VPN or application relay pattern. If the path looks engineered to defeat attribution, then the chain itself becomes a hunting signal, not just the payload it carries.

Why proxy chaining is attractive for C2, theft and persistence

Attackers use multi-hop proxying because it complicates response at the exact moment they need time. Concealing command-and-control reduces the chance of quick sinkholing or IP-based blocking, while masking data theft makes it harder to separate malicious transfer from normal outbound traffic. In longer intrusions, the same routing style can support persistence by making the operator’s true origin and infrastructure role less visible.

It also helps attackers preserve flexibility. If one relay is burned, they can rotate only part of the chain instead of exposing the whole path. That makes the technique especially useful when the intrusion depends on keeping the initial access channel alive long enough to move laterally or stage exfiltration.

Risk and Threat Considerations

Multi-hop proxying increases the defender’s detection burden because each additional relay weakens simple reputation-based blocking and can make benign and malicious traffic look similar at first glance. The main operational risk is false reassurance: teams may see a familiar proxy technology and miss the fact that the route itself is being used as an evasion layer.

Failure mechanism: The attacker spreads activity across multiple relays so no single host, IP, or geography tells the full story, which breaks straightforward attribution and can delay containment.

Impact: That delay can extend command-and-control uptime, increase the volume of data removed before detection, and make it harder to determine which systems were directly exposed to the intruder.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
MITRE ATT&CK	T1090 — Proxy	Multi-hop proxying is an attacker routing and evasion technique.
	T1095 — Non-Application Layer Protocol	Proxy chains often conceal C2 or exfiltration inside unusual transport paths.
Recommendation — Map observed relay chains to T1090 and hunt for proxy-based command-and-control. Inspect tunneled or nonstandard transport for hidden relay behavior.
CIS Controls v8	CIS-13 — Network Monitoring and Defense	Detecting unusual proxy chains depends on strong network visibility and alerting.
Recommendation — Instrument egress monitoring to flag unusual proxy chains and pivot-host patterns.
NIST CSF 2.0	DE.CM-01 — Monitor Networks and Network Services	The question centers on spotting abnormal network routes and traffic behavior.
	PR.AA-05 — Access Permissions and Authorizations	Proxy abuse often rides on misused access paths and delegated reach.
Recommendation — Monitor network service flows for relay patterns that do not fit approved routes. Restrict and review access paths that enable unauthorized relay or pivot activity.

Practitioner Guidance

What to prioritise: Treat the proxy path as evidence, not just the destination. Correlate proxy logs, DNS, authentication events and egress telemetry so you can reconstruct the chain rather than focusing only on the last hop.

What to verify: Confirm whether the apparent relay pattern matches an approved remote access architecture, managed service route, or sanctioned privacy tool. If it does not, look for the parent process, first-seen host and repeated session behaviour that created the chain.

What good looks like: You can explain why a multi-hop route exists, who owns each hop, and what normal traffic from that path should look like. If you cannot, the chain should be treated as a hunt lead and a possible containment trigger.

Practitioner takeaway: The hard part is not spotting a proxy, but proving whether the sequence of proxies is normal, authorized and traceable. When the route itself is the concealment mechanism, attribution and containment must move together.