Loading malware…
ReverseSocks5 is an open-source reverse SOCKS5 proxy and tunneling utility, written in Go, that is used to establish outbound proxy connections from compromised systems to attacker-controlled infrastructure. It is typically deployed during post-exploitation rather than as an initial access payload, enabling operators to create SOCKS5 tunnels for command and control, internal pivoting, and continued access while blending with legitimate outbound traffic.
The tool has been observed in intrusion activity involving exploitation of perimeter devices and enterprise networks. In campaigns exploiting PAN-OS firewalls via CVE-2026-0300, attackers used ReverseSocks5 alongside EarthWorm after achieving root-level compromise to provide outbound command-and-control and proxy tunneling from compromised firewalls. Associated post-exploitation activity included credential extraction, Active Directory enumeration, and anti-forensic log cleanup. ReverseSocks5 has also been used by the China-aligned espionage group LongNosedGoblin, which deployed it through NosyDownloader as part of a broader toolset targeting government entities in Southeast Asia and Japan. In separate reporting, activity tracked as Cavalry Werewolf used ReverseSocks5 and its agent component on compromised hosts during operations targeting the Russian public sector and related industries.
ReverseSocks5 is best characterized as an operator utility for covert network access and traffic relaying rather than a standalone malware family with autonomous infection logic. Its operational role is to provide proxying and tunneling capabilities that support persistence of access, lateral movement, and post-compromise command-and-control in espionage-oriented intrusions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2026-0300 is an unauthenticated buffer overflow in the User-ID Authentication Portal (Captive Portal) service of PAN-OS. The vendor advisory states that exploitation yields arbitrary code execution with root privileges on PA-Series and VM-Series firewalls... exploitation has been observed since April 9, 2026, with successful remote code execution achieved by April 16, 2026. | Observed post-exploitation activity includes shellcode injection into the nginx worker process on the firewall, Active Directory enumeration using credentials extracted from the firewall, anti-forensic log cleanup, and deployment of network tunneling tools (EarthWorm, ReverseSocks5) for outbound command and control.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Also executed on the compromised hosts are tools like ReverseSocks5Agent and ReverseSocks5, as well as commands to gather device information.
6 distinct techniques documented for this family, organized by ATT&CK tactic.
Then they deployed EarthWorm and ReverseSocks5 tunnels for outbound C2
In one case, the attacker uploaded on an internet-facing Microsoft Exchange Server a file named OutlookEN.aspx... OutlookEN.aspx corresponds to the HTTP proxy tunnel tool called suo5... The following public tools were observed on the victims’ network: • Proxy and tunneling: – Iox; – FRP; – NPS (NPC); – EarthWorm; – GoHTran; – ReverseSocks5; – Suo5;
Then they deployed EarthWorm and ReverseSocks5 tunnels for outbound C2
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Инструмент для обратного SOCKS5-туннелирования, применяемый для командно-контрольных каналов и латерального перемещения после компрометации PAN-OS-устройства.
A proxy tunneling utility deployed after exploitation of PAN-OS to maintain covert access, relay traffic, and enable internal pivoting through compromised firewall infrastructure.
ReverseSocks5 is an open-source networking tool designed to bypass firewalls and NAT protections by creating outbound connections from compromised systems to attacker-controlled servers. It establishes a SOCKS5 proxy tunnel that allows remote access into internal networks and is abused for stealthy pivoting and post-compromise operations.
SOCKS5-based reverse tunneling tool used post-compromise for outbound command and control.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.