Loading story…
Sophos detailed incident-response cases in which threat actors abused the legitimate tunneling service ngrok to establish command-and-control channels, deliver follow-on payloads, and expose internal systems to the internet. In the observed intrusions, attackers used PowerShell or wget to download ngrok, launched tunnels to TCP 3389 for remote desktop access, queried the local ngrok API, and fetched additional malware from ngrok-hosted URLs, taking advantage of the tool's trusted reputation and use of common network ports.
The guidance says defenders should verify whether ngrok is approved for business use before taking action, because the software is also widely used legitimately. Sophos recommended hunting across DNS, process, file, PowerShell, network, scheduled task, prefetch, registry, and Windows event log telemetry for evidence of abuse, and advised containment through domain and hash blocking, application-control policies, AppLocker, and proxy or firewall rules to prevent unauthorized ngrok activity.
Get the actors, campaigns, and ATT&CK mapping behind it.
1 event from the most recent confirmed update back to the earliest known activity.
Sophos Rapid Response published an incident-response guide describing how threat actors abuse the legitimate tunneling tool ngrok for command-and-control, payload delivery, and exposing internal services such as RDP to the internet. The guide also documented example intrusion scenarios, forensic artifacts, telemetry sources, and mitigation recommendations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported that cybercriminals are increasingly abusing cloud tunneling services—especially **ngrok**—to expose internal systems and hide malicious infrastructure behind temporary internet-facing tunnels. Trend Micro said ngrok accounted for about **99%** of the tunneling HTTP traffic it observed in 2021, and nearly **16,000** unique malware samples used ngrok to route command-and-control traffic. The activity spans phishing pages impersonating brands including Instagram, Facebook, Bank of America, Gmail, PayPal, Netflix, and Dropbox, as well as malware families such as **njRAT**, **DarkComet**, **AsyncRAT**, and **NanoCore**. Researchers also described internal abuse cases in which attackers exposed services like **SMB** and **HTTP** from compromised or corporate systems, including one incident where an exposed SMB service was used with **SmbExec** to gain a Windows shell and deploy a keylogger. Separate reporting tied ngrok infrastructure to the revived **rinfo** botnet, a bash-based scanning and cryptomining operation that used temporary `ngrok.io` domains for payload delivery and reporting. Netlab 360 said the campaign had logged **11,864** scanner samples, **1,754** miner samples, and **3,232** ngrok-based C2 domains by early 2021. The updated botnet dropped some older targets and added **Mongo**, **Confluence**, and **vBulletin**, while continuing to use internet scanning tools to find exposed services and deploying miners after compromise. The miner component also stole files named `credentials` and `.npmrc` from `/home` directories and modified firewall rules with `iptables`, underscoring how tunneling services are being folded into broader intrusion, persistence, and monetization workflows.
Aug 15, 2026
Threat actors are increasingly leveraging legitimate remote access tools, such as PuTTY and various remote monitoring and management (RMM) platforms, to facilitate lateral movement, data exfiltration, and persistent access within compromised networks. Attackers exploit the "living off the land" nature of these tools, blending their malicious activities with normal administrative operations to evade detection. In the case of PuTTY, adversaries use binaries like `plink.exe` and `pscp.exe` to move laterally and exfiltrate sensitive data, often leaving behind subtle forensic traces such as SSH host keys in the Windows registry. These artifacts can be crucial for investigators to reconstruct attacker activity, even after extensive log and artifact cleanup by the attackers. Similarly, security researchers have observed a surge in incidents where multiple RMM tools are abused in attack chains. Threat actors compromise or install RMM platforms like ScreenConnect, TeamViewer, Atera, NinjaRMM, and GoTo Resolve to maintain long-term access and persistence. Attackers often use phishing lures to trick victims into installing rogue RMM software, and may deploy several RMM tools in succession to ensure continued access even if one is detected and removed. These tactics highlight the ongoing challenge for defenders in distinguishing between legitimate and malicious use of remote access utilities, underscoring the need for robust monitoring and baselining of such tools within enterprise environments.
Jun 29, 2026
Multiple threat actors have used **SoftEther VPN** to turn compromised servers into covert relay infrastructure and maintain persistent access after initial intrusion. AhnLab reported that the **Larva-26010** group targeted web and **MS-SQL** servers in Korea, installing SoftEther components under `ProgramData`, disguising binaries as legitimate files such as `vmtoolsd.Exe`, and configuring cascade connections to upstream VPN servers to mask command-and-control paths. The intrusions also involved discovery commands, deployment of **CLR SqlShell**, registry changes including `UseLogonCredential`, web shell installation, and in one case creation of a local administrator-like account. Other reporting shows the same tunneling approach appearing in broader espionage operations. Mandiant found that **UNC3500** exploited **Log4Shell** (`CVE-2021-44228`) on public-facing MobileIron servers and established persistence with a **SoftEther/PacketiX VPN Bridge**, while Kaspersky said **ToddyCat** used **SoftEther VPN Server** alongside reverse SSH tunnels, **ngrok**, **FRP**, and a custom proxy to preserve access and support large-scale data theft from government and defense-related targets in the Asia-Pacific region. Across the cases, SoftEther was used not as the initial exploit but as post-compromise infrastructure for stealthy remote access, lateral movement support, and exfiltration-enabling traffic tunnels.
Aug 18, 2026