Full Report
At the end of this tunnel, we find some shady hackers using ngrok to gain remote control access to victim networks.
Analysis Summary
# Tool/Technique: Ngrok Tunneling Abuse
## Overview
Ngrok is a legitimate cross-platform reverse proxy tool designed to expose local server ports to the internet through secure tunnels. While intended for developers to demo applications or bypass NAT/firewalls, threat actors abuse it to establish persistent, stealthy remote access, exfiltrate data, and bypass traditional perimeter defenses by tunneling protocols like RDP, SSH, and VPN traffic.
## Technical Details
- **Type:** Attack Tool / Technique (Living-off-the-Land via Third-Party Utility)
- **Platform:** Windows, macOS, Linux
- **Capabilities:** Port forwarding, NAT traversal, subdomains for local services, TCP/HTTP tunneling.
- **First Seen:** March 2021 (Reported context of specific RDP/VPN abuse).
## MITRE ATT&CK Mapping
- **[TA0011 - Command and Control]**
- **[T1572 - Protocol Tunneling]**: Using Ngrok to encapsulate traffic through a secure tunnel to bypass firewalls.
- **[T1090.002 - Proxy: External Proxy]**: Using Ngrok's infrastructure as an external proxy for C2.
- **[TA0003 - Persistence]**
- **[T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder]**: Launching Ngrok scripts via startup mechanisms.
- **[TA0005 - Defense Evasion]**
- **[T1036.005 - Masquerading: Match Legitimate Name or Location]**: Renaming the Ngrok binary to `conhost.exe` or other system process names.
## Functionality
### Core Capabilities
- **NAT Traversal:** Allows internal services to be reached from the public internet without modifying router settings.
- **Protocol Support:** Tunnels HTTP, HTTPS, and raw TCP traffic (enabling RDP, SSH, and SMB access).
- **Public Endpoints:** Generates unique URLs (e.g., `*.ngrok.io`) to route traffic to the victim machine.
### Advanced Features
- **Config-Driven Tunnels:** Use of `.yml` files to define multiple simultaneous tunnels and regions (e.g., `eu`, `us`, `ap`).
- **Persistence Integration:** Can be wrapped in VBScripts or PowerShell to run silently in the background (hidden windows) and survive reboots.
- **Authentication Bypass:** Tunnels encrypt traffic, often making it invisible to Deep Packet Inspection (DPI) that isn't looking for Ngrok's specific handshake.
## Indicators of Compromise
- **File Names:** `ngrok.exe`, `ngrok.yml`, renamed binaries like `conhost.exe` (when found in non-standard paths like `C:\ProgramData\`).
- **Network Indicators:**
- `*.ngrok.io`
- `tunnel.ngrok.com`
- Connections to Ngrok infrastructure on non-standard ports.
- **Behavioral Indicators:**
- VBScripts invoking `WScript.Shell` to run `powershell -windowstyle hidden`.
- `conhost.exe` running with arguments like `--config`, `--all`, or `--region`.
- Unusual outbound connections from servers to Ngrok-owned IP ranges.
## Associated Threat Actors
- Used by a wide variety of actors, from low-level script kiddies to sophisticated **Ransomware Groups** and **APTs** for initial access and long-term persistence.
## Detection Methods
- **Signature-based detection:** Detecting the Ngrok binary hash (though frequently updated) and specific configuration file syntax.
- **Behavioral detection:**
- Monitoring for command-line arguments specific to Ngrok (e.g., `start --config`).
- Identifying parent-child process anomalies (e.g., a VBScript spawning a hidden PowerShell process that calls a renamed Ngrok binary).
- **Network Monitoring:** Flagging DNS queries for `ngrok.io` and associated subdomains within enterprise environments.
## Mitigation Strategies
- **Application Whitelisting:** Prevent the execution of unauthorized binaries like `ngrok.exe`.
- **Egress Filtering:** Block outbound traffic to known Ngrok domains and IP ranges at the firewall level if not required for business.
- **Endpoint Monitoring:** Audit `C:\ProgramData` and `C:\Users\Public` for unexpected executable files or configuration files.
- **Host Hardening:** Disable WScript/CScript if not required for administrative tasks to prevent VBScript-based execution.
## Related Tools/Techniques
- **Localtunnel / Cloudflare Tunnel (Argo):** Similar services used for exposing local ports.
- **Chisel:** A fast TCP/UDP tunnel over HTTP.
- **Frp (Fast Reverse Proxy):** A high-performance reverse proxy used in similar attack scenarios.