How do attackers use a connection proxy?

Why a connection proxy matters to defenders

A connection proxy is not just a routing detail, it changes what you can observe and what the attacker can reach. When traffic is relayed through an intermediary, source attribution becomes harder and controls that rely on direct origin visibility may be bypassed. That makes proxy use operationally important even when the underlying protocol is ordinary.

In practice, proxying is useful to attackers because it supports both concealment and access. If an internal host suddenly begins making outbound connections to an unexpected proxy, or if a proxy chain appears where one is not approved, the behaviour can indicate staging, evasion, or a pivot path used to reach blocked services indirectly.

How attackers abuse proxies to hide and move

Attackers often use proxies to separate the system that initiates activity from the system that ultimately receives it. That can frustrate IP-based blocking, complicate geolocation-based filtering, and make it harder to tie a command channel or data transfer to a single source. In some cases, the proxy is only a transit point; in others, it is part of a broader chaining pattern designed to blend with normal network behaviour.

The same mechanism can support lateral movement once an internal foothold exists. If a compromised internal system is allowed to relay traffic freely, the attacker may use that trust path to reach services that would otherwise be inaccessible, especially where segmentation is weak or outbound egress is overly broad. For that reason, proxy activity should be evaluated alongside destination, timing, and the role of the host making the connection.

When proxying is legitimate, it is usually bounded by clear policy and known infrastructure. When it is not, the question is not only where the traffic went, but whether the proxy itself became part of the attack path. That distinction matters because the presence of a proxy can hide the real source while also masking the next stage of exploitation.

What defenders should look for in proxy traffic

Unexpected proxy use is most useful as a behavioural signal, not a standalone verdict. The strongest indicators are unusual outbound destinations, new proxy endpoints on internal systems, repeated connection attempts that fail and retry through different intermediaries, and traffic patterns that do not match the host’s normal function. A proxy used from a workstation, server, or service account outside its normal role deserves immediate review.

Defenders should also compare proxy activity with approved exceptions. If a system is not supposed to proxy, or if a destination is not on an allowlist, the event should be treated as a control gap until proven otherwise. This is especially important where proxies are used to bypass egress filtering, because the same pattern can support exfiltration, command-and-control, or access to blocked internal resources.

Useful detection comes from correlation. Pair proxy logs with DNS, firewall, endpoint, and authentication telemetry so you can determine whether the connection was user-driven, script-driven, or initiated by a service process. That context helps separate a misconfiguration from attacker tradecraft.

Risk and Threat Considerations

proxy abuse increases the chance that malicious traffic will blend into normal outbound communication, which weakens monitoring and can delay containment. It also raises the likelihood that a compromised internal host will be used as a relay for additional access, making the proxy itself part of the attacker’s trust chain.

Failure mechanism: The proxy hides origin and destination relationships, allowing an attacker to route through an intermediary, bypass simple blocking rules, and reuse a trusted internal path for further access or exfiltration.

Impact: Defenders may lose attribution, miss early signs of lateral movement, and allow blocked services or data transfers to continue through a path that appears routine.

Practitioner Guidance

What to verify: Confirm which hosts are authorised to use proxies, which destinations are allowed, and whether any recent proxy connections came from systems that should never initiate them. If the proxy is on an exception path, validate the business justification and the owner of that exception.

Decision rule: If the proxy use is unexplained or inconsistent with the host’s role, treat it as a suspicious access path first and a networking issue second. Investigate the source host, the destination, and any adjacent authentication or process activity before assuming it is benign.

Practitioner takeaway: The key judgement is whether the proxy is a controlled relay or an attacker-controlled blind spot, because that difference determines whether you are handling a normal network route or an evasion channel.

Related resources from NHI Mgmt Group

• Guide: OT Security Guide
• How do attackers use list planting?
• How do attackers use invisible Unicode?
• How do attackers turn a supply-chain incident into wider NHI compromise?
• How do attackers operationalise stolen OAuth tokens at scale?