FTP/SSH Proxy Abuse for Anonymization via Squid

Ankit Mehta@Secvyn

•updated Jun 25, 2026•1•0•7

Detects instances where the Squid proxy application is used to establish network connections over ports 21 (FTP) or 22 (SSH) to specific external IP ranges. This behavior may indicate an attacker using the internal proxy server to anonymize command-and-control (C2) traffic or perform unauthorized external reconnaissance.