go-socks5
go-socks5 is a reverse tunneling proxy used by the Iran-linked threat actor MuddyWater (also tracked as Mango Sandstorm / TA450) in a campaign active from September 30, 2024, to March 18, 2025. In the reported activity, MuddyWater primarily targeted Israeli organizations across academia, engineering, local government, manufacturing, technology, transportation, utilities, and universities, and also targeted at least one entity in Egypt. The tooling was used alongside the Fooder loader, the MuddyViper backdoor, and credential- and browser-theft tools including CE-Notes and LP-Notes. Reporting states that a C/C++ loader was observed deploying go-socks5 reverse tunneling proxies, and that the campaign also used spear-phishing and exploitation of VPN vulnerabilities for initial access. The reverse tunneling capability was part of an intrusion set assessed as increasingly stealthy and difficult to defend against, with operators maintaining a low profile by avoiding interactive sessions. High-confidence associated tooling and behaviors mentioned in the source include deployment via Fooder, use with MuddyViper for covert access, and use in operations focused on espionage and credential theft.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The attackers also employed CE-Notes and LP-Notes stealers and go-socks5 reverse tunnels.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
SOCKS5-based reverse tunneling/proxy tool used to provide covert network access (reverse tunnels).
An open-source reverse tunneling proxy used for covert network access.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.