T1572 · ATT&CK technique
Protocol Tunneling
15 actors on record using it
Every mark is an actor ATT&CK records using this technique. Red ones also exploit a CVE in CISA KEV.
Open T1572 on attack.mitre.orgAdversaries may tunnel network communications to and from a victim system within a separate protocol to avoid detection/network filtering and/or enable access to otherwise unreachable systems. Tunneling involves explicitly encapsulating a protocol within another. This behavior may conceal malicious traffic by blending in with existing traffic and/or provide an outer layer of encryption (similar to a VPN). Tunneling could also enable routing of network packets that would otherwise not reach their intended destination, such as SMB, RDP, or other traffic that would be filtered by network applian…
Source: MITRE ATT&CK, T1572. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Every one of the 15 is a mark on the map. Named now: 1 to 15, most on record first.
- OilRig
- Mustang Panda
- APT35
- FIN7
- Leviathan
- Scattered Spider
- Chimera
- Handala Hack
- Salt Typhoon
- FIN13
- Ember Bear
- FIN6
- Fox Kitten
- Cobalt Group
- Cinnamon Tempest
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: MITRE ATT&CK (© The MITRE Corporation, reproduced and distributed with its permission), the MISP Galaxy (CC0), and CyberSIXT's own coverage.