T1496.002, Bandwidth Hijacking, is the use of a compromised system's network bandwidth for someone else's work. It applies to Linux, Windows, macOS, IaaS and containers, and falls under impact.
How attackers use it
MITRE lists several uses. Malware can use a system's bandwidth in a botnet to carry out network denial of service campaigns, or to seed malicious torrents. Adversaries may engage in proxyjacking, selling use of the victim's bandwidth and IP address to proxyware services. They may also scan the internet to find more targets.
The harm includes cost, lost availability, and reputational damage if the bandwidth is used for illegal activity.
How to detect it
MITRE describes five analytics.
- Processes that launch network heavy child processes or send large uploads over long lived sessions to unfamiliar destinations.
- User started processes with sustained outbound traffic on common or nonstandard ports, often outside business hours. Tools such as curl, wget, masscan or proxy clients fit.
- On macOS, long lived or high throughput connections from apps not normally associated with uploads.
- Containers or sidecars that send heavy outbound traffic or act as proxy relays, especially after sudden spikes in interface statistics while idle.
- Cloud workloads with sustained outbound data rates, often to Tor, VPN or proxy endpoints, with unusual IAM activity or scheduled scripts running proxy clients.
MITRE does not name log sources. Network flow data, egress volume per workload and process telemetry are what you need.
How to reduce the risk
MITRE says prevention is hard because the technique uses normal system features. Alert on egress anomalies per workload, restrict outbound traffic from servers and containers to what they need, and watch the bill.
Quick check
What is proxyjacking?
Selling use of a victim's network bandwidth and IP address to proxyware services.
