{
  "family": "redirected",
  "sample_count": 2,
  "category": "trojan",
  "description": "Behavior:Win32/Redirected is a severe **Heuristic Detection** that flags unauthorized changes to the system's network configuration aimed at intercepting, monitoring, or manipulating outbound web traffic. This behavior is typically exhibited by advanced adware, banking trojans, and sophisticated Man-in-the-Middle (MitM) spyware attempting to capture credentials or inject malicious content into legitimate websites.<br><br><b>Understanding Redirected (Traffic Proxying)</b><br>To an end-user, this behavior might manifest as SSL certificate errors on usually secure sites (like banks), inexplicably slow browsing speeds, or an overwhelming number of injected advertisements on legitimate pages. For a security analyst, a Redirected alert indicates a critical breach of network integrity (`T1562.004`). The malware has successfully positioned itself between the user's browser and the internet.<br><br><b>Execution and Hijacking Mechanics</b><br>Malware triggers this detection through several techniques. It may modify the system-wide Windows Proxy Settings via the Registry (`T1112`), forcing all browser traffic through a locally hosted proxy server controlled by the malware. Alternatively, it might install a malicious Root Certificate Authority (CA) into the Windows Certificate Store (`T1553.004`), allowing the local proxy to seamlessly decrypt, inspect, and re-encrypt HTTPS traffic (TLS inspection) without triggering browser warnings. The malware can then steal credentials or inject banking trojan 'web injects' (`T1185`).<br><br><b>Indicators of Compromise & Impact</b><br>The impact is a total loss of confidentiality for all web traffic originating from the endpoint. Host-based IoCs include EDR alerts for modifications to `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer`, the unexpected installation of new Root Certificates, or unknown processes listening on local ports (like `127.0.0.1:8080`). Network IoCs might include all outbound HTTP/HTTPS traffic routing to a single, unexpected external IP address.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Redirected and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Redirected is classified as a Trojan. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Redirected establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Redirected typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Redirected compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Redirected should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary payloads and staging behaviors are commonly associated with Redirected?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Redirected frequently operates as a loader or dropper designed to establish a foothold before downloading and executing secondary high-impact malware payloads. Depending on the threat actor's objectives, these dropped modules can range from ransomware and banking injects to modular infostealers and remote management backdoors."
      }
    },
    {
      "@type": "Question",
      "name": "How can security operations teams effectively detect and hunt for Redirected across enterprise endpoints?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Defenders should hunt for Redirected by deploying behavioral endpoint detection and response (EDR) rules that monitor suspicious process spawning (such as cmd.exe or powershell.exe spawned from office documents or temporary directories), anomalous outbound network connections from non-browser binaries, and unauthorized modifications to Windows Run keys and scheduled task registries."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1562.004",
    "T1553.004",
    "T1185"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall (Modifying Proxy Settings)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1553.004",
      "name": "Subvert Trust Controls: Install Root Certificate (Enabling MitM)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1185",
      "name": "Browser Session Hijacking (Injecting malicious content via local proxy)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "Immediately isolate the endpoint; all communications, including credentials typed into secure websites, are actively being intercepted.",
    "Open the Windows Internet Options and manually disable any unauthorized proxy server settings.",
    "Audit the Windows Certificate Manager (`certmgr.msc`) and remove any suspicious or recently installed Root Certificate Authorities.",
    "Initiate an enterprise-wide password reset for the user, assuming all recently used credentials have been compromised via the MitM attack."
  ],
  "what_to_avoid": [
    "Do not allow the user to log into any corporate portals until the proxy settings and rogue certificates are completely removed.",
    "Avoid assuming a simple AV scan will fix the issue; AVs often miss the rogue Root Certificates which must be removed manually."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}