A back-connect proxy is a malware or post-compromise design where an infected host does more than wait for commands: it opens an outbound connection and relays attacker traffic through itself. Instead of acting only as a victim, the system becomes a transport node in the attacker’s path, forwarding control sessions, pivot traffic, or other data streams.
This matters because outbound proxying can blend into normal network behavior and bypass simple inbound-blocking defenses. It also obscures attribution: logs may show the compromised host as the source of the traffic, even though the operator is behind it. Defenders look for unusual outbound connections, unexpected relay behavior, and protocol abuse, especially when a legitimate service or NAT-traversal protocol is being used as camouflage. In real attacks, back-connect proxies are often combined with persistence so the relay survives reboot and can continue serving the operator.