Multi-hop Proxy is a routing setup that sends traffic through two or more proxy systems before reaching its destination. Attackers use it to hide origin and complicate tracing, so defenders should look for chained proxy patterns, unusual egress destinations, and mismatches between endpoint, gateway, and identity telemetry.
How Multi-hop Proxy Works
A multi-hop proxy adds layers between the source and the destination, so each relay only sees part of the path. That design can be legitimate for privacy, testing, or traffic engineering, but it also makes attribution harder because no single hop has the full routing picture.
For defenders, the important point is not the number of hops alone, but whether the chain is consistent with approved architecture. A proxy chain that appears where direct routing is expected often changes the investigation from simple destination review to path reconstruction and trust-boundary analysis.
Why Multi-hop Proxy Is Used in Offensive Tradecraft
Attackers use multi-hop proxying to obscure origin, split telemetry across systems, and frustrate correlation across endpoint, gateway, DNS, and identity logs. In practice, the chain may be combined with relays, tunnels, or other infrastructure intended to break simple source tracing.
This is one reason multi-hop proxy patterns show up alongside command-and-control infrastructure. The Command and Control (C2) Guide covers beaconing, egress filtering, DNS analytics, and related detection paths that often become relevant when proxy chains are used to stage or conceal control traffic.
Multi-hop designs can also overlap with delegated or chained access models in modern automation environments. Multi-Agent and A2A Security Guide is useful when the reader needs to understand how multi-step trust and delegation chains should be contained and verified, even though the underlying subject here is network routing rather than agent communication.
How Defenders Detect and Investigate It
Detection usually starts with correlation. If an endpoint, gateway, proxy, and authentication system disagree about the same session, the gap may indicate a relay chain, a masking layer, or a logging blind spot rather than a normal client path.
Practical investigation looks for repeated proxy intermediaries, unusual egress destinations, nonstandard proxy software, and traffic that changes identity or geolocation assumptions midstream. The best signal is often a pattern, not a single event, especially when the proxy chain is used only for selected destinations or during specific windows.
Where chained routing becomes part of a broader intrusion pattern, defenders can map observed infrastructure and behavior to MITRE ATT&CK Enterprise Matrix to support triage, hunt hypotheses, and post-incident reconstruction.
Controls That Reduce Exposure
The strongest controls are architectural and operational: restrict outbound paths, log proxy hops consistently, and verify that proxy use matches business purpose. If proxy chaining is allowed, document approved relay points and make deviations visible in monitoring, not merely in policy.
Network teams should also treat egress control as a detection aid, not just a firewall setting. When a chain is abnormal, the goal is to narrow the number of places where traffic can disappear, redirect, or re-emerge under a different trust context.
For broader hardening of routing, trust, and least-privilege network paths, NIST SP 800-207 Zero Trust Architecture helps frame why every hop should be explicitly evaluated rather than implicitly trusted.
Risk and Threat Considerations
Multi-hop proxying increases the chance that defenders lose sight of origin, session continuity, or responsibility for a connection. That matters because the same technique can be used for privacy-preserving routing or for concealment, and the difference is usually visible only in the surrounding telemetry and policy context.
Failure mechanism: Chained relays can break end-to-end visibility, reduce the reliability of source attribution, and let malicious traffic blend into allowed proxy usage or trusted intermediary infrastructure.
Impact: Investigations take longer, alert fidelity drops, and compromised systems can communicate, stage payloads, or exfiltrate data with less chance of straightforward tracing.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1090 — Proxy | Multi-hop proxying is a proxy-based defense-evasion and C2 routing pattern. |
| Recommendation — Map chained relay patterns to T1090 and hunt for concealed control or exfiltration paths. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitor for Anomalies and Events | Multi-hop proxy use is often exposed through anomaly monitoring across network and identity telemetry. |
| PR.AA-05 — Identity Management, Authentication and Access Control | Routing through intermediaries becomes riskier when approved access paths and trust boundaries are unclear. | |
| Recommendation — Correlate proxy, gateway, and identity logs to detect abnormal relay chains. Constrain proxy usage to approved access paths and verify each hop against policy. | ||
Practitioner Guidance
What to watch for: Treat mismatches between endpoint evidence, gateway logs, proxy records, and identity telemetry as a prompt to reconstruct the full path before concluding that a session is benign. The most useful response is to compare what each control plane believes happened, not to rely on one log source alone.
Governance implication: If your organisation permits proxy chaining, define where it is allowed, who owns the exceptions, and how the approved route is validated over time. Ambiguous routing policy tends to become a blind spot long before it becomes a formal incident.
Related resources from NHI Mgmt Group
- Why do multi-hop AI agent workflows create more risk than single-agent automation?
- How should security teams govern multi-hop agent delegation chains?
- Why do multi-hop delegation chains increase identity risk?
- How should teams use multi-hop relationships in a knowledge graph for governance decisions?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org