REVSOCKSRevSocks

RevSocks (revsocks) is an open-source reverse SOCKS5 tunneler written in Go (TLS, DNS tunneling, proxy support) and a dual-use utility. In October 2026, SOCRadar described its use by the Russian-speaking operators of the AI-driven 'Phantom' intrusion ecosystem, affiliated with the INC and The Gentlemen ransomware groups, to pivot inside victim networks and to stage and collect data over reverse-SOCKS tunnels. ESET separately found that the reverse SOCKS5 proxy command of the MythicRatatoskr backdoor (UAC-0099/Sandworm) and its C2 server code are largely derived from revsocks, based on its debug strings and on TLS certificates rotated the way revsocks generates them. Because the tool is public, its presence alone does not indicate a specific actor, so it is not linked to any actor here.