MalwareUsed by 2 actorsExploits 1 CVE

ligolo-ng

Ligolo-ng is an open-source, Go-based tunneling and pivoting tool used in legitimate red-team engagements and repeatedly abused in intrusions. It establishes encrypted reverse TCP/TLS tunnels between an agent on a compromised system and an operator-controlled proxy, enabling covert remote access, traffic relaying, and pivoting into internal networks. Threat actors have deployed it after compromising Windows systems, Linux servers, and Citrix NetScaler appliances, including for persistent remote access through services or scheduled execution. It has been observed in ransomware, espionage, and financially motivated operations, including activity attributed or linked to Medusa, Akira, UAC-0247, and APT28-aligned operations. Ligolo-ng is commonly used alongside credential-access, remote-access, and lateral-movement tooling to reach otherwise inaccessible internal systems.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2023-3519Unauthenticated RCE in Citrix NetScaler ADC and GatewayExploited in the wild

CISA is releasing this Cybersecurity Advisory to warn network defenders about exploitation of CVE-2023-3519, an unauthenticated remote code execution (RCE) vulnerability affecting NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway. In June 2023, threat actors exploited this vulnerability as a zero-day to drop a webshell...

via cisacisa.gov

THREAT ACTORS

Groups observed using it

2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

UAC-0247

Для побудови прихованих тунелей можуть використовуватися програмні засоби LIGOLO-NG та CHISEL.

via cert uacert.gov.ua

APT28

Notably, port 11601 ran Ligolo-ng, a tunneling and pivoting tool popular in red team operations... used the C2 server as a pivot point for tunneling into compromised networks.

via huntio bloghunt.io

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

2 techniques

T1588.002ToolEvidence3

The attackers deployed or downloaded GSOCKET, pspy64, whatserver.sh, and likely Ligolo-ng.

T1608.001Upload MalwareEvidence1

MITRE ATT&CK Mapping ... Stage Capabilities: Upload Malware T1608.001 Open directory on :8000 with 9 tools

Initial Access

1 technique

T1133External Remote ServicesEvidence2

In Phase 1, the actor uses VPN software and tools such as Chisel and Ligolo to establish network routes and turn its server into an attack platform.

Persistence

2 techniques

T1133External Remote ServicesEvidence2

In Phase 1, the actor uses VPN software and tools such as Chisel and Ligolo to establish network routes and turn its server into an attack platform.

T1543.003Windows ServiceEvidence1

Sophos XDR detected the threat actors using the service manager tool nssm.exe... to create the malicious service ‘sysmon,’ which executed sysmon.exe and launched tunneling tools such as Ngrok or Ligolo-ng

Privilege Escalation

1 technique

T1543.003Windows ServiceEvidence1

Lateral Movement

1 technique

T1570Lateral Tool TransferEvidence1

tries to move laterally on the network, and uses publicly available utilities, like the RustScan port scanner, the Ligolo-ng and Chisel tunneling tools

Command and Control

10 techniques

T1071Application Layer ProtocolEvidence2

At least two payloads of SystemBC ... communicated with that IP around 2023-10-27 ... Again, we found that this IP address resolved o*.*.claudfront[.]net on 2024-03-15 (see section in the main text dedicated to DecoyDog: DNS tunnelling as C2).

T1071.001Web ProtocolsEvidence1

T1071.001 — Application Layer Protocol: Web Protocols (Command and Control)

T1090ProxyEvidence10

“Cloudflare tunnel (cloudflared.exe tunnel run --token). Ngrok or Ligolo-ng tunneling via nssm.exe as fake ‘sysmon’ service.”

T1090.001Internal ProxyEvidence1

SSH Dynamic Port Forwarding (SOCKS Proxy)... You then configure proxychains... the traffic will be seamlessly tunneled through the SSH connection into the internal network.

T1090.002External ProxyEvidence3

launched tunneling tools such as Ngrok or Ligolo-ng to establish remote access to the compromised machines

T1090.003Multi-hop ProxyEvidence2

Durring our CTI research on Karakurt / Conti Servers we are able to identify the use of SOCKS proxy pivoting technique with a open source tool called Ligolo-ng against multiple victims.

T1105Ingress Tool TransferEvidence4

As part of their initial exploit chain [T1190], the threat actors uploaded a TGZ file [T1105] containing a generic webshell [T1505.003], discovery script [TA0007], and setuid binary [T1548.001] on the ADC appliance.

T1571Non-Standard PortEvidence1

MITRE ATT&CK Mapping ... Non-Standard Port T1571 Ports 4040, 2083, 8181, 11601

T1572Protocol TunnelingEvidence5

«ssh -w создаёт пару виртуальных tun-интерфейсов... получаешь point-to-point SSH туннель... весь трафик к внутренней подсети идёт через SSH».

T1573.002Asymmetric CryptographyEvidence1

LIGOLO-NG is a tunneller [T1572] written in Go that provides encrypted reverse TCP/TLS connections [T1573.002] to a remote host.

INDICATORS OF COMPROMISE

IOCs tracked for this family

39 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

29 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

6 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app9 days ago

uri●●●●●●●●●●●●View more in app24 days ago

domain●●●●●●●●●●●●View more in app6 months ago

hash.md5●●●●●●●●●●●●View more in app6 months ago

ACTIVITY FEED

Recent activity

11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

11 SOURCESView more in app

cyberveilleNews

Aug 19, 2026

Mise à jour advisory CISA AA25-071A : Medusa RaaS weaponise de nouveaux CVE en 24h | CyberVeille

Tunneling/pivoting tool used in Medusa-related command-and-control activity.

huntio blogNews

Aug 4, 2026

The Gentlemen Affiliate Deploys EtherRAT Across Windows Networks Using Ethereum Smart Contract C2

Tunneling utility staged as part of the operator toolkit to support network pivoting and remote access.

cyber security newsNews

Apr 16, 2026

1,250+ C2 Servers Mapped Across Russian Hosting Across 165 Providers

A tunneling/offensive security tool observed on the infrastructure and repurposed for malicious use.

cert uaNews

Apr 15, 2026

CERT-UA

A tunneling/proxy tool used to build covert tunnels within compromised environments.

+5 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching39

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution2

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

ligolo-ng