Threat intelligence / Tool

ngrok

[ngrok](https://attack.mitre.org/software/S0508) is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. [ngrok](https://attack.mitre.org/software/S0508) has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration.(Citation: Zdnet Ngrok September 2018)(Citation: FireEye Maze May 2020)(Citation: Cyware Ngrok May 2019)(Citation: MalwareBytes LazyScripter Feb 2021)

Tool

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[ngrok](https://attack.mitre.org/software/S0508) is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. [ngrok](https://attack.mitre.org/software/S0508) has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration.(Citation: Zdnet Ngrok September 2018)(Citation: FireEye Maze May 2020)(Citation: Cyware Ngrok May 2019)(Citation: MalwareBytes LazyScripter Feb 2021)

Labels

tool

12 recorded

Relationships

revoked-by

from Ngrok

Malware

uses

from Ember Bear

Group

uses

from Fox Kitten

Group

uses

from LazyScripter

Group

uses

to Domain Generation Algorithms

Technique

uses

to Exfiltration Over Web Service

Technique

uses

to Protocol Tunneling

Technique

uses

Technique

uses

Technique

uses

Group

uses

from Scattered Spider

Group

uses

from SharePoint ToolShell Exploitation

Campaign

5 external

References

mitre-attack

S0508

Zdnet Ngrok September 2018

https://www.zdnet.com/article/sly-malware-author-hides-cryptomining-botnet-behind-ever-shifting-proxy-service/

Cyware Ngrok May 2019

https://cyware.com/news/cyber-attackers-leverage-tunneling-service-to-drop-lokibot-onto-victims-systems-6f610e44

MalwareBytes LazyScripter Feb 2021

https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf

FireEye Maze May 2020

https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html