MITRE ATT&CKsoftware (tool)

S0508 ngrok

Published 2023-09-14 Modified 2025-10-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.4
Created
2023-09-14

Description

ngrok is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. ngrok has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration.

Related

Uses · MITRE ATT&CK (5)

  • T1572 Protocol Tunneling technique
  • T1568.002 Domain Generation Algorithms sub-technique
  • T1567 Exfiltration Over Web Service technique
  • T1090 Proxy technique
  • T1102 Web Service technique

Referenced by MITRE ATT&CK · uses (6)

  • C0058 SharePoint ToolShell Exploitation campaign
  • G1015 Scattered Spider group
  • G1003 Ember Bear group
  • G0140 LazyScripter group
  • G0117 Fox Kitten group
  • G0049 OilRig group

References