Yuze Reverse Proxy Execution

Elgonad .@elgonad

•updated Mar 20, 2026•0•38

Detects the execution of the open-source Yuze tool via rundll32 to establish a reverse SOCKS5 proxy tunnel. The Warlock ransomware group has been observed using this lightweight C-based tunneling tool to maintain persistent C&C access across multiple ports.