Loading story…
Security researchers reported that cybercriminals are increasingly abusing cloud tunneling services—especially ngrok—to expose internal systems and hide malicious infrastructure behind temporary internet-facing tunnels. Trend Micro said ngrok accounted for about 99% of the tunneling HTTP traffic it observed in 2021, and nearly 16,000 unique malware samples used ngrok to route command-and-control traffic. The activity spans phishing pages impersonating brands including Instagram, Facebook, Bank of America, Gmail, PayPal, Netflix, and Dropbox, as well as malware families such as njRAT, DarkComet, AsyncRAT, and NanoCore. Researchers also described internal abuse cases in which attackers exposed services like SMB and HTTP from compromised or corporate systems, including one incident where an exposed SMB service was used with SmbExec to gain a Windows shell and deploy a keylogger.
Separate reporting tied ngrok infrastructure to the revived rinfo botnet, a bash-based scanning and cryptomining operation that used temporary ngrok.io domains for payload delivery and reporting. Netlab 360 said the campaign had logged 11,864 scanner samples, 1,754 miner samples, and 3,232 ngrok-based C2 domains by early 2021. The updated botnet dropped some older targets and added Mongo, Confluence, and vBulletin, while continuing to use internet scanning tools to find exposed services and deploying miners after compromise. The miner component also stole files named credentials and .npmrc from /home directories and modified firewall rules with iptables, underscoring how tunneling services are being folded into broader intrusion, persistence, and monetization workflows.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
By February 6, 2021, Netlab 360 telemetry had captured 11,864 rinfo scanner samples, 1,754 miner samples, and 3,232 ngrok.io command-and-control domains tied to the renewed campaign.
From January 1 through December 31, 2021, Trend Micro found nearly 16,000 unique malware samples using ngrok to route command-and-control traffic, with njRAT the most observed family.
ngrok made an abuse-reporting page available for reporting misuse of its service.
Netlab 360 reported that a new variant of the bash-based rinfo botnet had been observed spreading again since mid-October 2020, heavily relying on temporary ngrok.io domains for payload delivery and reporting.
In July 2020, Trend Micro discovered an attack in which an attacker exposed SMB over ngrok, used SmbExec to obtain a local Windows shell, and then downloaded and executed a keylogger.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 110 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
3 references tracked. Mallory keeps watching after this page renders.
trendmicro.com
Open sourceblog.netlab.360.com
Open sourcengrok.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Sophos detailed incident-response cases in which threat actors abused the legitimate tunneling service **ngrok** to establish command-and-control channels, deliver follow-on payloads, and expose internal systems to the internet. In the observed intrusions, attackers used **PowerShell** or `wget` to download ngrok, launched tunnels to **TCP 3389** for remote desktop access, queried the local ngrok API, and fetched additional malware from ngrok-hosted URLs, taking advantage of the tool's trusted reputation and use of common network ports. The guidance says defenders should verify whether ngrok is approved for business use before taking action, because the software is also widely used legitimately. Sophos recommended hunting across **DNS, process, file, PowerShell, network, scheduled task, prefetch, registry, and Windows event log** telemetry for evidence of abuse, and advised containment through domain and hash blocking, application-control policies, **AppLocker**, and proxy or firewall rules to prevent unauthorized ngrok activity.
Jun 29, 2026
Researchers identified two active remote access trojan operations built on commodity malware families, with one involving a customized QuasarRAT variant dubbed **DollRAT** or **"Lilly's RAT V8"** and the other using **njRAT v0.7d (Bladabindi)**. DollRAT was observed using a modified QuasarRAT `v1.4.1` codebase with **ConfuserEx** obfuscation, runtime string decryption, and command-and-control traffic routed through an **ngrok** TCP tunnel at `0.tcp.eu.ngrok.io:18107`, backed by AWS infrastructure in Frankfurt. The malware supports credential theft from browsers and FTP clients, keylogging with HTML-formatted logs, system reconnaissance, remote shell access, file management, remote desktop, registry changes, reverse proxying, and persistence through Run keys and scheduled tasks. Embedded branding including **"Lilly's RAT V8"** and **"C.U.M Software Inc."** suggests an actively maintained custom build rather than an unmodified public RAT. A separate analysis tracked an **njRAT** sample named `Client.exe` to a broader campaign using the hardcoded No-IP hostname `njspider.myddns.me` on TCP port `4444`, resolving to Belgian residential IP `62.235.6.231`. That operation has reportedly been active since at least late 2025, with multiple related binaries and rapid rebuilds sharing the same infrastructure. The njRAT sample retained standard capabilities including persistence via `HKCU` Run keys, keylogging, screenshots, webcam capture, remote shell, file transfer, plugin execution, USB spreading, and plaintext TCP beaconing. Across both cases, operators relied on legitimate services such as **ngrok**, **No-IP**, `ipwho.is`, and `api.ipify.org` to mask or support C2 activity, while the tooling and infrastructure pointed to low-sophistication but active commodity malware operations.
Jun 29, 2026
Multiple malware campaigns delivered remote access trojans including **NanoCore**, **NetWire**, **AsyncRAT**, **Quasar RAT**, and **PlugX** through phishing lures and staged payloads behind legitimate-looking files. Cisco Talos reported a campaign that used malicious ZIP archives containing ISO images and heavily obfuscated JavaScript, batch, or VBScript loaders to fetch additional malware from **Microsoft Azure** and **Amazon Web Services**, while **DuckDNS** domains supported delivery and command-and-control. Fortinet separately documented travel-themed lures such as itinerary and booking files that pushed **AsyncRAT** and **NetWire**, often requiring victims to manually launch executables hidden inside ZIP or ISO containers; the use of ISO files helped bypass **Mark-of-the-Web** protections and reduced security scrutiny. Fortinet also linked a separate espionage operation attributed to **APT10** to DLL side-loading with the legitimate Java component `jjs.exe`, loading a malicious `jli.dll`, decrypting `svchost.bin`, and injecting shellcode into `svchost.exe` to deploy **PlugX** and a modified **Quasar RAT**. That activity used persistence via a service or a Run key named **"Windows Updata"**, and relied on typosquatted infrastructure such as `update.microsofts.org`, `update.kaspresksy.com`, and `cahe.microsofts.org`. CISA has also tracked **Quasar** as an open-source remote administration tool, underscoring how both commodity and state-linked actors continue to rely on RAT malware, cloud-hosted staging, dynamic DNS, and deceptive attachment formats to gain and maintain access.
Aug 15, 2026