Hila Cohen, Amit Waisel - Malproxy: Leave Your Malware at Home
Introduces Malproxy, an architecture for executing malicious operations through a reverse proxy that keeps malware off the victim's machine.
Summary
Proxy-Based Malware Architecture
Hila Cohen and Amit Waisel (security researchers, SafeBreach) present Malproxy, a novel attack architecture that separates the malicious payload from the victim's machine by executing it on a remote attacker-controlled server.
Architecture Overview
Malproxy deploys only a thin, seemingly benign agent on the victim machine. The agent establishes a reverse connection to the attacker's server and proxies all system API calls back to the attacker, where the actual malicious code executes in a controlled environment.
Evasion Benefits
Because no malicious code executes on the victim's machine (only the proxy agent), file-based and memory-based malware scanning finds nothing suspicious. AV/EDR products cannot analyze code running on the remote attacker server.
Demonstration
Cohen and Waisel demonstrate running a complete credential dumping operation (LSASS dump) through Malproxy, with only the proxy agent visible on the victim machine and the actual Mimikatz execution occurring on the attacker's server.
Related talks
Main Stage·47 min
Dimitry Snezhkov
Presents advanced C2 communication obfuscation techniques that blend malicious traffic into legitimate business protocols.
Main Stage·42 min
Jason Lang
Introduces advanced offensive networking techniques and covert communication channels to bypass modern enterprise perimeter monitoring and EDR telemetry.
Main Stage·42 min
Gal Weizman
Demonstrates how WebRTC channels and enterprise web conferencing platforms can be repurposed as stealthy command-and-control and data exfiltration pipelines.