Skip to main content
Mallory
MalwareRansomwareUsed by 2 actors

gost

GOST is a proxy and tunneling tool observed in multiple intrusion sets as attacker infrastructure rather than as a standalone malware family. In the provided reporting, it was used to establish SOCKS5 proxies, HTTPS tunnels, reverse communication channels, and persistent tunnels that exposed internal services and maintained reliable external access from compromised environments. It was deployed alongside other tunneling utilities including FRP/frps, IOX Proxy, Wstunnel, and tunnel-core.exe variants.

The content links GOST to several threat contexts. Trend Micro reported its use in the China-aligned cyberespionage cluster SHADOW-EARTH-053 after exploitation of legacy Microsoft Exchange and IIS systems, including ProxyLogon vulnerabilities, where operators used GOST as part of post-compromise covert communications and operational redundancy. Elastic Security Labs documented TeamPCP using gost and frps inside compromised container and Kubernetes environments to proxy traffic and maintain persistent tunnels during multi-stage cloud-native intrusions. Separate reporting on the PCPcat campaign states that compromised Next.js servers downloaded scripts that installed GOST SOCKS5 proxy software and FRP reverse tunneling tools, with persistence implemented through auto-restarting systemd services including names such as pcpcat-gost.service.

Observed behaviors in the content include installation of GOST on compromised servers, use for SOCKS5 proxying, use inside containerized workloads, and long-lived deployment as attacker infrastructure. VulnCheck’s infrastructure analysis noted that GOST proxies often remained online for extended periods, with a reported median duration of 48 days and some instances persisting through a full 90-day observation window, indicating its role as durable operational infrastructure for threat actors. High-confidence indicators directly mentioned in the content include execution or installation references to GOST, persistent service naming such as pcpcat-gost.service, and association with attacker infrastructure at 67.217.57.240 in the PCPcat reporting where proxy and tunneling tooling was downloaded.

Share:
For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details
Shadow-Earth-053

Observed tooling included IOX Proxy, GOST, Wstunnel, and multiple tunnel-core.exe variants. These tools established SOCKS5 proxies, HTTPS tunnels, and reverse communication channels to attacker infrastructure.

via polyswarmblog.polyswarm.io
TeamPCP

Tunneling tools: TeamPCP uses frps (fast reverse proxy) and gost for establishing persistent tunnels and proxying through compromised container environments

via handlers diary fullisc.sans.edu
MITRE ATT&CK

Techniques & procedures

11 distinct techniques documented for this family, organized by ATT&CK tactic.

T1588.002ToolEvidence1

Multiple groups “obtained and used” publicly available/open-source tools (e.g., APT28 used Koadic/Mimikatz/Responder; APT29 used Mimikatz/SDelete/Tor/meek/Cobalt Strike; many others acquired tools such as PsExec, Impacket, Metasploit, etc.).

Initial Access

2 techniques
T1133External Remote ServicesEvidence1

Tunneling tools: TeamPCP uses frps (fast reverse proxy) and gost for establishing persistent tunnels and proxying through compromised container environments

T1190Exploit Public-Facing ApplicationEvidence1

The primary payload, tplink_stager.sh, was designed for post-exploitation of CVE-2024-21833, an OS command injection vulnerability affecting TP-Link Archer and Deco series routers.

Persistence

2 techniques
T1133External Remote ServicesEvidence1

Tunneling tools: TeamPCP uses frps (fast reverse proxy) and gost for establishing persistent tunnels and proxying through compromised container environments

T1543.002Systemd ServiceEvidence1

Persistence was achieved via six systemd services... TeamPCP proxy.sh creates six systemd services with Restart=always.

T1543.002Systemd ServiceEvidence1

Persistence was achieved via six systemd services... TeamPCP proxy.sh creates six systemd services with Restart=always.

T1071Application Layer ProtocolEvidence2

TeamPCP uses frps (fast reverse proxy) and gost for establishing persistent tunnels and proxying through compromised container environments

T1090ProxyEvidence12

Access entirety of Workstation A's private LAN (Sock4/4a/5 proxy) $ gs-netcat -l -S # Workstation A (EXIT) $ gs-netcat -p 1080 # Workstation B

T1090.002External ProxyEvidence2

Several entries mention use of proxy and tunneling tools including PLINK, Venom proxy, GOST reverse proxy, Ligolo, Cloudflared, rsocx reverse proxy, Iox proxy tool, NPS tunneling tool, and AirVPN.

T1090.003Multi-hop ProxyEvidence1

Observed tooling included IOX Proxy, GOST, Wstunnel, and multiple tunnel-core.exe variants. These tools established SOCKS5 proxies, HTTPS tunnels, and reverse communication channels to attacker infrastructure.

T1105Ingress Tool TransferEvidence4

Downloading microsocks binaries, GOST, FRP, and scanner modules from C2.

T1571Non-Standard PortEvidence1

ShadowLink on port 7443; TeamPCP staging on 666, FRP on 888.

T1572Protocol TunnelingEvidence5

TeamPCP FRP reverse tunnel from victim SOCKS5 to C2:890.

INDICATORS OF COMPROMISE

IOCs tracked for this family

13 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app
Hashes
13 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting
hash.sha256●●●●●●●●●●●●View more in app21 days ago
hash.sha256●●●●●●●●●●●●View more in app21 days ago
hash.sha256●●●●●●●●●●●●View more in app21 days ago
hash.sha256●●●●●●●●●●●●View more in app21 days ago
hash.sha256●●●●●●●●●●●●View more in app21 days ago
hash.sha256●●●●●●●●●●●●View more in app21 days ago
What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.
IOC matching13

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping11

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.