Chisel: The Single-Binary Tunnel Attackers Use to Pivot

Chisel is an open-source, fast TCP/UDP tunnel transported over HTTP and secured via SSH, distributed as a single self-contained executable that acts as both client and server. Its legitimate purpose is penetrating firewalls and NAT to reach internal services over an encrypted channel. Threat actors abuse it to pivot through compromised perimeter and edge devices into internal networks, to proxy lateral-movement traffic, and to build encrypted outbound channels for C2 and exfiltration. It is written in Go by Jordan Pillar (jpillora), which is why it compiles to a single cross-platform static binary. Chisel has no official MITRE ATT&CK Software entry; its technique mappings are analyst-assigned.

Capabilities

• Reverse tunneling — the client dials out and the server exposes the port — to defeat inbound firewall and NAT restrictions. T1572
• Built-in SOCKS5 proxy mode for generic internal proxying. T1090.001
• Multiplexed TCP and UDP port forwarding over one connection. T1090
• Encrypted transport: SSH over HTTP/WebSockets, with authentication and optional fingerprint pinning. T1071.001

Real-World Abuse

• Cisco Talos (UAT-9686): Chisel used to proxy traffic through compromised Cisco AsyncOS appliances to pivot into internal environments; Talos assessed with moderate confidence a Chinese-nexus APT.
• SentinelOne: PYSA ransomware operators consistently used Chisel for tunneling, with a recurring file name and folder path across intrusions.
• CrowdStrike/Wiz: an actor tunneled SSH, RDP, MSSQL and MySQL lateral-movement traffic through a Chisel tunnel.
• Hive Pro (“Spirals”): operators stood up multiple tunnelers — including Chisel — within the first minutes of intrusion, in legitimate-looking directories, for redundant encrypted outbound channels.

MITRE ATT&CK Mapping

Detection & Mitigation

• Layer detections and treat any one alone as evadable: the default invocation uses client/server subcommands and SOCKS and reverse-forward (R:) flags (Sigma “PUA - Chisel Tunneling Tool Execution”), but renaming the binary defeats command-line and image-name rules.
• On the wire, the Chisel server answers the WebSocket upgrade with an HTTP 101 containing the plaintext banner SSH-chisel-v3-server (Emerging Threats/Suricata rules match it) — visible only while the handshake is observable.
• YARA rules match the embedded Go module path github.com/jpillora/chisel with an ELF-header and file-size check, catching renamed copies; Elastic prebuilt rules look for the client/server arguments followed by a network connection from an uncommon parent process.
• Hunt anomalous long-lived outbound HTTP/WebSocket sessions from servers and edge devices; harden and monitor perimeter appliances (common pivot points); restrict egress and apply application control to block unapproved single-binary tools.