ATT&CK T1090 is the MITRE ATT&CK technique family for proxy use in command-and-control and traffic relay. In practice, an attacker routes network traffic through one or more intermediary systems so the true source, destination, or operator is harder to identify. Common examples include public proxies, compromised servers, routers, or other edge devices acting as relays.
This matters because proxying helps attackers hide infrastructure, bypass filtering, and survive takedowns by shifting traffic through new hops. For defenders, the challenge is that the final connection may look like ordinary HTTPS or cloud traffic unless logs and flow data are examined closely. Detection often relies on egress control, anomaly hunting, unusual relay patterns, and correlation across multiple network layers. In short, T1090 describes an obfuscation and routing pattern that can support covert command-and-control, credential abuse, or other hidden activity.