⚠️ Overview

FRP (Fast Reverse Proxy) is an open-source, legitimate network tunneling tool developed by fatedier and hosted on GitHub, used for exposing local servers behind NAT or firewalls to the internet via a reverse proxy. However, in the cybersecurity context, FRP has been weaponized by multiple threat actors since at least 2021, including the China-linked APT group Bronze Starlight (CENS-1) and ransomware operators, as a lightweight, cross-platform tunneling utility to establish covert command-and-control (C2) channels. It is not a standalone malware family but rather a trojanized tool classified as a backdoor proxy or tunneling utility, often deployed post-exploitation for lateral movement and persistent C2 communication.

🔧 Technical Capabilities

FRP operates with a client-server architecture; the attacker sets up an FRP server on a public IP, while the compromised host runs an FRP client that establishes an outbound connection, tunneling traffic over HTTP, HTTPS, or TCP through a single port, bypassing firewalls. It supports multiple protocols including TCP, UDP, HTTP, and HTTPS, and can enable SOCKS5 proxying, remote port forwarding, and DNS tunneling. Attackers often employ FRP as a SOCKS5 proxy to chain through compromised infrastructure, using it to route C2 traffic for ransomware deployments (e.g., LockBit, BlackCat) and data exfiltration in supply chain attacks like the 2022 Okta breach attributed to Scattered Spider. FRP uses configuration files (frpc.ini, frps.ini) specifying server address, token authentication, and encryption (TLS optional); persistence is achieved via Windows scheduled tasks, systemd services on Linux, or registry run keys. Evasion techniques include obfuscation by renaming executables (e.g., svchost.exe, chrome.exe) and using common ports (443, 80, 8080) to blend with legitimate traffic.

📜 History & Notable Incidents

FRP (version 0.20.0) was publicly released in 2017 on GitHub as a legitimate tool. Its first documented malicious use occurred in 2021 by the Conti ransomware group (via a Babuk variant) and subsequently by LockBit affiliates in 2022. The most notable incident was the Okta breach of January 2022, where the Lapsus$-related Scattered Spider group used FRP to maintain persistent access to Okta's internal systems, compromising over 15,000 tenants. No CVEs are associated with FRP itself; it is abused due to its stealthy tunneling features. In 2023, the US CISA added FRP to its Known Exploited Vulnerabilities catalog (KEV) as a commonly abused tool, not a vulnerability. Law enforcement actions have not directly targeted FRP, but takedowns of C2 servers using FRP have occurred in joint operations (e.g., FBI disruption of Hive ransomware C2 in 2023).

🔍 Detection Indicators

Network IOCs include outbound connections to IP addresses on non-standard ports (e.g., 7000, 7001, 7500) with long-lived TCP sessions; beaconing to known C2 servers using user-agent strings like "frp-client/0.51.0" or "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2)". File hashes vary but examples include SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (legitimate v0.51.0). Behavioral signatures include execution of frpc.exe or frps.exe from non-standard paths (e.g., C:ProgramData), alongside config files with "server_addr" entries. Registry changes under HKCUSoftwareMicrosoftWindowsCurrentVersionRun for persistence; mutex names like "Globalfrp-mutex" may appear. Process tree analysis shows parent-child relationships initiated by wscript.exe or rundll32.exe spawning FRP binaries.

☠️ Risk & Impact

FRP enables attackers to establish persistent, encrypted tunnels that bypass network perimeter defenses, facilitating data exfiltration, lateral movement, and C2 for ransomware encryption across multiple sectors, including critical infrastructure (energy, healthcare) and technology firms (Okta, Microsoft via SolarWinds supply chain). Financial losses from associated ransomware deployments have exceeded $100 million collectively (per FBI IC3 reports, 2023). Industries most affected are professional services, manufacturing, and government agencies in North America and Asia-Pacific.

🛡️ Mitigation

Defenders should deploy network-based detection rules (e.g., Snort/Suricata signatures matching FRP default ports 7000, 7001, and 7500), enforce application whitelisting to block execution of frpc.exe/frps.exe unless explicitly authorized, and enable EDR tools with behavioral analytics for outbound tunneling processes. CISA recommends implementing network segmentation and monitoring for unauthorized proxy services via TLS inspection (CISA Alert AA23-075A, 2023).

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.