ngrokTool
ngrok is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. ngrok has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration.From MITRE ATT&CK
Last reported 3 days ago, by Group-IB10 reports
ATT&CK techniques
6 of 98 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“T1021.001 Remote Services: Remote Desktop Protocol”
- T1036Masquerading
“T1036 Masquerading”
- T1053.005Scheduled Task
“T1053.005”
- T1219Remote Access Tools
“T1219”
- T1003.001LSASS Memory
“T1003.001”
- T1018Remote System Discovery
“T1018”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
10 reports, newest first · the exact sentence from each-
Stray Cat, Open Doors: How k0t Wanders Through the Network Edge“…(controlled via a MeshCentral panel) as well as AdaptixC2, and many other commonly abused RMM tools such as Atera, Teramind, AnyDesk and ngrok.”
-
Rust-Based CikaBika Bot Turns Discord into a Command Center““The observed use of Discord channels for individual victims, alongside additional data exfiltration through ngrok, shows how legitimate services can be repurposed to support malicious operations.””
-
ThreatsDay: Adobe RCE, DNS Wallet Theft, NVIDIA Container Escape, Self-Healing Backdoor + 23 More“…bypass, and DLL search-order hijacking before leveraging Discord for C2, reconnaissance, remote execution, and data exfiltration through ngrok in observed malicious activity," Darktrace said.”
-
Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments“For example, Storm-2570 uses Atera to install agents and execute interactive commands, while ngrok and Cloudflared.exe expose RDP services or establish persistent outbound tunnels.”
-
Grand Theft Auto VI hype leads to malware“They also connect to secure tunneling services provided by ngrok at 7.tcp.eu.ngrok.io:12684.”
-
Living off the coding agent: Two tales of tunnels and LaunchAgents“The destinations and command shapes also line up with known free tunnel providers (localhost.run / lhr.life, trycloudflare, ngrok, etc.), a local loopback app pattern, and ordinary SaaS APIs.”
-
Linux & Cloud Detection Engineering - TeamPCP Container Attack Scenario“"ssf", "3proxy", "ngrok", "wstunnel", "pivotnacci", "frps",”
-
Breaking Down S3 Ransomware: Variants, Attack Paths and Trend Vision One™ Defenses“However, creating a domain would be costly for an attacker and risks exposing them, so they instead use ngrok to tunnel the local host to a temporary HTTPS public site.”
-
BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies“For additional capabilities to access the compromised network, the attackers could use tunnels built using ngrok or gost, or software such as TeamViewer or ScreenConnect.”
-
Abusing Ngrok: Hackers at the End of the Tunnel“In this case, we saw artifacts that indicate a hacker used ngrok to tunnel traffic from RDP and VPN ports out to the open Internet.”
Thanks — we review every report.