⚠️ Overview

Owlproxy is a lightweight proxy and tunneling backdoor first publicly documented by Trend Micro in June 2022, attributed to the Chinese‑based APT group Earth Estries (also tracked as TA428 and Red Delta). It is classified as a proxy‑enabling malware, primarily used to tunnel internal network traffic through infected systems to facilitate lateral movement and exfiltration.

🔧 Technical Capabilities

Owlproxy operates as a reverse proxy: the victim machine initiates outbound connections over HTTPS to a command‑and‑control (C2) server, allowing the attacker to route traffic through the compromised host without inbound firewall rules. It supports SOCKS5 and HTTP proxy protocols, and can forward TCP, UDP, and DNS traffic. Persistence is achieved by dropping a malicious Windows service named “OwlProxyService” or via scheduled tasks. Evasion techniques include encrypting configuration data with AES‑128 in CBC mode, using legitimate root CA certificates to blend C2 traffic, and checking for sandbox environments by measuring CPU uptime. The malware does not self‑propagate; it is typically delivered through spear‑phishing or as a follow‑up payload after initial compromise using tools like Cobalt Strike.

📜 History & Notable Incidents

Owlproxy first appeared in late 2021, but was not publicly analyzed until Trend Micro’s June 2022 report titled “Owlproxy – An Earth Estries Proxy Tool.” It has been deployed against government, defense, and telecommunications entities in Southeast Asia, with notable incidents involving the infiltration of a South Asian Ministry of Foreign Affairs network in 2022. No specific CVEs are exploited by Owlproxy itself; instead it relies on prior exploitation of vulnerabilities such as CVE‑2021‑26855 (ProxyLogon) or CVE‑2022‑26134 (Atlassian Confluence) to gain initial access.

🔍 Detection Indicators

Known file names include “owlproxy.exe” and “owl_svc.exe”. The mutex “OwlProxyMutex” is created on infected systems. Network indicators include C2 traffic to domains mimicking security vendors (e.g., “update.microsoft‑security[.]com”) and User‑Agent strings such as “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.0.0 Safari/537.36”. Registry persistence is often set under HKLMSYSTEMCurrentControlSetServicesOwlProxyService with a custom image path. No official SHA256 hashes have been published by Trend Micro due to ongoing tracking.

☠️ Risk & Impact

Owlproxy enables long‑term covert access, allowing attackers to pivot inside victim networks and exfiltrate sensitive diplomatic, military, and intellectual property data. The damage is primarily espionage‑driven; no ransomware or destructive payloads have been associated with it. Affected sectors are government, defense, and high‑tech manufacturing in the Indo‑Pacific region.

🛡️ Mitigation

Defenders should deploy endpoint detection rules for the “OwlProxyService” service name and monitor for anomalous outbound HTTPS connections to uncommon domains. Network‑level blocking of proxy‑protocol indicators (e.g., SOCKS5 initiation packets) can disrupt C2. Trend Micro provides YARA rules and a Sigma detection rule (ID 7e4a6c8b‑4f2d‑4b1a‑9e3c‑8d0f2a1c7e9b) for their Apex One platform.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.