S1144 · tool · ATT&CK software
FRP
3 actors on record using it
Every mark is an actor ATT&CK records using this software. Red ones also exploit a CVE in CISA KEV.
Open S1144 on attack.mitre.orgFRP, which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT) to the Internet. FRP can support multiple protocols including TCP, UDP, and HTTP(S) and has been abused by threat actors to proxy command and control communications.
Source: MITRE ATT&CK, S1144. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Every one of the 3 is a mark on the map. Named now: 1 to 3, most on record first.
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-14 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.