FRP — Malware Profile

FRP, which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT) to the Internet. FRP can support multiple protocols including TCP, UDP, and HTTP(S) and has been abused by threat actors to proxy command and control communications.

MITRE ATT&CK techniques (10)

• T1046 Network Service Discovery
• T1049 System Network Connections Discovery
• T1059.007 JavaScript
• T1071.001 Web Protocols
• T1090 Proxy
• T1090.003 Multi-hop Proxy
• T1095 Non-Application Layer Protocol
• T1572 Protocol Tunneling
• T1573.001 Symmetric Cryptography
• T1573.002 Asymmetric Cryptography

Attributed threat actors

• Blue Mockingbird
• APT35
• Volt Typhoon

Read the full analysis on IntelFusions