So attackers specify an external C&amp;C server in the command line and the tool connects to this server using HTTP. This remote server is used as a proxy by attackers: the connection that goes to this server is redirected to the internal network by the tool and any response that the tool gets from a computer in the internal network goes to the C&amp;C server. Thus, attackers can communicate with internal servers that are normally unreachable from the internet