H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Socksbot](https://attack.mitre.org/software/S0273) is a backdoor that abuses Socket Secure (SOCKS) proxies. (Citation: TrendMicro Patchwork Dec 2017)

Labels

malware

5 recorded

Relationships

uses

to Dynamic-link Library Injection

Technique

uses

to PowerShell

Technique

uses

to Process Discovery

Technique

uses

to Proxy

Technique

uses

to Screen Capture

Technique

3 external

References

mitre-attack

S0273

open

Socksbot

—

TrendMicro Patchwork Dec 2017

https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf

open