MITRE ATT&CKsoftware (tool)

S1144 FRP

Published 2024-07-10 Modified 2026-05-12 Official page ↗
Domain
enterprise
Platforms
Linux, macOS, Windows
Version
1.1
Created
2024-07-10

Description

FRP, which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT) to the Internet. FRP can support multiple protocols including TCP, UDP, and HTTP(S) and has been abused by threat actors to proxy command and control communications.

Related

Uses · MITRE ATT&CK (10)

  • T1059.007 JavaScript sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1572 Protocol Tunneling technique
  • T1090.003 Multi-hop Proxy sub-technique
  • T1046 Network Service Discovery technique
  • T1049 System Network Connections Discovery technique
  • T1090 Proxy technique
  • T1095 Non-Application Layer Protocol technique

Referenced by MITRE ATT&CK · uses (6)

  • C0060 Operation AkaiRyū campaign
  • C0057 3CX Supply Chain Attack campaign
  • C0043 Indian Critical Infrastructure Intrusions campaign
  • G1017 Volt Typhoon group
  • G0108 Blue Mockingbird group
  • G0059 Magic Hound group

References