Proxyjacking / bandwidth hijacking
Sells victim bandwidth to proxy networks or abuses cloud/SMS services
categoryMalwareseverityMediumdetectabilityMediumlabnot yet measured
Classification
32 values: 13 reviewed, 18 imported, 1 derived. What do these mean?
Exploitability
| Attack vector | Malware |
|---|---|
| Reach (CVSS) | Local |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Attacker skill required | Low |
| Resources required | Low |
| Likelihood / prevalence | High |
| Maturity | Commoditized |
Impact & scope
| Severity | Medium |
|---|---|
| Impact | Availability |
| Platform | ContainersIaaSLinuxmacOSSaaSWindows |
| Environment | CloudOn-premises |
| Target asset class | EndpointServer |
| Kill-chain phase (tactic) | Impact |
Detection & telemetry
| Detectability | Medium |
|---|---|
| Data sources (ATT&CK data components) | Application Log ContentCloud Service ModificationInstance StartNetwork Connection CreationNetwork Traffic ContentNetwork Traffic FlowProcess CreationUser Account Authentication |
Detection & response
Mitigated by 1
- M1013 attack-mitigation
Detected by 3
Attack relationships
Framework references
- Primary source: https://attack.mitre.org/techniques/T1496/
- attack: T1496.002 (primary)
- attack: T1496.003
- attack: T1496.004
Evidence & sources
- ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Malware' table, line 98 of Cyber-Attack-Taxonomy.md