{
  "family": "ultrasurf",
  "sample_count": 7,
  "category": "advanced_threat",
  "description": "PUA:Win32/Ultrasurf represents a unique classification in enterprise security. Technically, Ultrasurf is a freeware Internet censorship circumvention tool, originally designed to allow users in restrictive countries to bypass national firewalls via an encrypted proxy network. However, in a corporate environment, it is almost universally classified as a Potentially Unwanted Program (PUA) or Riskware because it actively subverts enterprise security controls, bypasses content filtering, and creates an unmonitored encrypted tunnel out of the network.<br><br><b>Understanding Ultrasurf in the Enterprise</b><br>To an end-user, Ultrasurf is a convenient way to access blocked websites (like social media or streaming services) from the office. For a security operations center (SOC) or network administrator, Ultrasurf is a massive compliance and security risk. By tunneling traffic through external proxies, it renders Data Loss Prevention (DLP) systems, malware inspection, and acceptable use policies completely blind (`T1562.004`). Furthermore, third-party repackaged versions of Ultrasurf frequently bundle aggressive adware or spyware.<br><br><b>Execution and Evasion Mechanics</b><br>Ultrasurf is uniquely designed for stealth. It is usually a single, portable executable (`u.exe`) that requires no installation or administrative privileges (`T1204.002`), meaning any user can run it. Upon execution, it establishes an encrypted TLS connection to a proprietary network of proxy servers (`T1090.003`). It then dynamically alters the local endpoint's Windows Internet Options (`inetcpl.cpl`) (`T1562`), forcing all local web browsers (IE, Chrome, Edge) to route their HTTP/HTTPS traffic through a local loopback port (e.g., `127.0.0.1:9666`), which Ultrasurf then encrypts and sends out through its proxy tunnel. Upon closure, it attempts to clean up its tracks and restore the proxy settings.<br><br><b>Indicators of Compromise & Impact</b><br>The primary impact is the total bypass of perimeter security controls and potential exposure to unvetted external networks. Host-based IoCs include EDR alerts for the execution of unsigned portable executables from the `%Downloads%` or `%Temp%` folders, followed immediately by modifications to the `HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer` registry key. Network IoCs include a high volume of encrypted TLS traffic flowing to unknown, rapidly changing IP addresses over standard port 443.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Ultrasurf and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ultrasurf is classified as a Advanced Threat. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ultrasurf establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ultrasurf typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Ultrasurf compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Ultrasurf should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What lateral movement and credential access tactics does Ultrasurf leverage in enterprise intrusions?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ultrasurf frequently utilizes privileged account harvesting techniques such as LSASS memory dumping, Kerberoasting, and token impersonation to escalate privileges. Once administrative credentials are acquired, it pivots across the victim network utilizing living-off-the-land binaries (LOLBins) such as WMI, PowerShell remoting, and PsExec, or abuses remote desktop protocols (RDP) to reach critical internal repositories and domain controllers."
      }
    },
    {
      "@type": "Question",
      "name": "How does Ultrasurf maintain covert communications and evade perimeter network monitoring?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Ultrasurf often relies on multi-stage command and control (C2) architectures utilizing encrypted protocols over standard web ports (HTTPS/443 or DNS tunneling) to blend in with legitimate enterprise network traffic. Many variants incorporate proxy networks, domain fronting, or cloud services (such as Microsoft Graph API, Google Drive, or Telegram) to masquerade C2 channels, bypassing traditional signature-based egress filtering."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1204.002",
    "T1562",
    "T1090.003",
    "T1562.004"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1090.003",
      "name": "Proxy: Multi-hop Proxy (Tunneling traffic via Ultrasurf network)",
      "tactic": "Command and Control"
    },
    {
      "id": "T1562.004",
      "name": "Impair Defenses: Disable or Modify System Firewall (Bypassing enterprise web filters)",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1204.002",
      "name": "User Execution: Malicious File (Portable execution)",
      "tactic": "Execution"
    },
    {
      "id": "T1562",
      "name": "Impair Defenses (Modifying local proxy settings)",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Terminate the Ultrasurf process. Ensure the user's local proxy settings (`inetcpl.cpl`) are restored to the corporate default, otherwise they will lose all internet access.",
    "Implement Application Control (like Windows AppLocker or WDAC) to block the execution of known Ultrasurf hashes and unapproved portable executables.",
    "Configure Next-Generation Firewalls (NGFW) to block the specific Ultrasurf application signature, rather than just IP addresses (which change constantly).",
    "Remind users of the corporate Acceptable Use Policy regarding the bypass of security controls."
  ],
  "what_to_avoid": [
    "Do not rely on IP blocklisting to stop Ultrasurf; it dynamically utilizes hundreds of proxy servers and cloud providers to evade static blocks.",
    "Avoid assuming the tool is benign; repackaged versions from unofficial sources often contain secondary malware payloads."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}