S0508: ngrok
Security context for executives and security teams
ngrok is legitimate software, but in ATT&CK it matters because a reverse proxy tunnel can give an attacker a path into or out of a Windows environment without needing an exposed public service. For leaders, the practical question is not whether ngrok is “bad,” but whether the organization can distinguish approved tunneling from unauthorized use that could support command-and-control, lateral movement, or data exfiltration.
Executive priority
Treat ngrok as an egress-control and incident-response readiness issue. Business risk comes from trusted-looking web traffic and encrypted tunnels bypassing assumptions about firewall protection, especially on servers or endpoints where tunneling tools have no business purpose. The ATT&CK relationship to SharePoint ToolShell Exploitation also makes this relevant to vulnerability response: patching exposed applications is necessary, but teams should also verify whether post-exploitation tunneling would be visible and containable.
Technical view
ATT&CK lists ngrok as a Windows tool with relationships to Proxy, Web Service, Exfiltration Over Web Service, Domain Generation Algorithms, and Protocol Tunneling. Because no official detection is provided, SOC and IR teams should validate coverage through local evidence: process execution for ngrok or renamed binaries, command-line and configuration artifacts, outbound tunnel establishment, DNS/proxy activity to external web services, and long-lived encrypted connections from systems that should not initiate tunnels. Investigation context should include whether the host has an approved administrative or development use case for ngrok.
Likely telemetry
- Windows process creation and command-line logging
- Endpoint file and binary execution evidence
- Parent-child process relationships on Windows hosts
- DNS query logs
- Web proxy and secure web gateway logs
Detection direction
- Build an allowlist of approved ngrok use cases, owners, hosts, and time windows; treat everything else as reviewable.
- Hunt for ngrok execution, renamed copies, suspicious working directories, or unexpected child processes launching network tunnels.
- Correlate process telemetry with outbound DNS/proxy/firewall events instead of relying on network indicators alone.
- Prioritize alerts when tunneling behavior originates from servers, privileged workstations, or recently exploited/vulnerable internet-facing systems.
- Tune for false positives from developers, support teams, and administrators who may legitimately use reverse tunnels.
Mitigation priorities
- Define policy for approved reverse proxy and tunneling tools, including ownership and business justification.
- Restrict unauthorized tunneling utilities through application control or endpoint policy where feasible.
- Enforce outbound egress controls so sensitive servers cannot freely initiate external tunnels.
- Use proxy/firewall logging and DNS visibility to create audit evidence for web-service and tunnel monitoring.
- Include tunneling checks in incident response playbooks for suspected compromise and in vulnerability response for exposed services.
Additional notes and limits
The object is a legitimate tool, so detection value depends heavily on business context. ATT&CK relationships show use by multiple groups and one campaign, but that should be used for prioritization and threat-informed hunting, not as proof of local exposure or current activity. The revoked S9000 Ngrok entry has been consolidated into this object.
MITRE provides no official detection text for this object, no ATT&CK tactics directly on the tool object, and only Windows as the listed platform for ngrok here. Local inventories, approved software lists, proxy visibility, and endpoint logging are required to determine whether use is legitimate or suspicious.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
ngrok
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1090 | Proxy | |
| Enterprise | T1567 | Exfiltration Over Web Service | |
| Enterprise | T1568.002 | Domain Generation AlgorithmsSub-technique | |
| Enterprise | T1102 | Web Service | |
| Enterprise | T1572 | Protocol Tunneling |
Groups, software, and campaigns
G0049: OilRig
OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. The group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.[1][2][3][4][5][6][7]
G1003: Ember Bear
Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).[1] Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.[2] Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022.[3][4][1] There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles.[2][5]
G1015: Scattered Spider
Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]
G0140: LazyScripter
LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.[1]
G0117: Fox Kitten
Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.[1][2][3][4]
S9000: Ngrok
Official MITRE ATT&CK object mirrored from source data.
C0058: SharePoint ToolShell Exploitation
The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors Threat Group-3390 and ZIRCONIUM. SharePoint ToolShell Exploitation targeted multiple regions and industries including finance, education, energy, and healthcare across Asia, Europe, and the United States.[1][2][3][4][5]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Imported snapshots across ATT&CK releases(1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.4 | Current bundle | 4e66f5e0de51… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
- [1]Zdnet Ngrok September 2018
Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.
Open source URL - [2]FireEye Maze May 2020
Kennelly, J., Goody, K., Shilko, J. (2020, May 7). Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents. Retrieved May 18, 2020.
Open source URL - [3]Cyware Ngrok May 2019
Cyware. (2019, May 29). Cyber attackers leverage tunneling service to drop Lokibot onto victims’ systems. Retrieved September 15, 2020.
Open source URL - [4]MalwareBytes LazyScripter Feb 2021
Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.
Open source URL - [5]Trend Micro Earth Simnavaz October 2024
Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024.
Open source URL - [6]MalwareBytes Ngrok February 2020
Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020.
Open source URL - [7]Microsoft SharePoint Exploit JUL 2025
Microsoft Threat Intelligence. (2025, July 22). Disrupting active exploitation of on-premises SharePoint vulnerabilities. Retrieved October 15, 2025.
Open source URL - [8]Cadet Blizzard emerges as novel threat actor
Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.
Open source URL - [9]CISA Scattered Spider Advisory November 2023
CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.
Open source URL - [10]CrowdStrike Scattered Spider JUL 2025
Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025.
Open source URL - [11]Check Point Scattered Spider JUL 2025
Check Point Team. (2025, July 7). Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation. Retrieved October 13, 2025.
Open source URL - [12]Trend Micro Ngrok September 2020
Borja, A. Camba, A. et al (2020, September 14). Analysis of a Convoluted Attack Chain Involving Ngrok. Retrieved September 15, 2020.
Open source URL - [13]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL - [14]Cyware Ngrok May 2019
Cyware. (2019, May 29). Cyber attackers leverage tunneling service to drop Lokibot onto victims’ systems. Retrieved September 15, 2020.
Open source URL - [15]Cyware Ngrok May 2019
Cyware. (2019, May 29). Cyber attackers leverage tunneling service to drop Lokibot onto victims’ systems. Retrieved September 15, 2020.
Open source URL - [16]FireEye Maze May 2020
Kennelly, J., Goody, K., Shilko, J. (2020, May 7). Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents. Retrieved May 18, 2020.
Open source URL - [17]FireEye Maze May 2020
Kennelly, J., Goody, K., Shilko, J. (2020, May 7). Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents. Retrieved May 18, 2020.
Open source URL - [18]MalwareBytes LazyScripter Feb 2021
Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.
Open source URL - [19]MalwareBytes LazyScripter Feb 2021
Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.
Open source URL - [20]Zdnet Ngrok September 2018
Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.
Open source URL - [21]Zdnet Ngrok September 2018
Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.
Open source URL - [22]mitre-attackS0508Open source URL
- [23]mitre-attackS0508Open source URL
- [24]mitre-attackS0508Open source URL
- [25]Trend Micro Earth Simnavaz October 2024
Fahmy, M. et al. (2024, October 11). Earth Simnavaz (aka APT34) Levies Advanced Cyberattacks Against Middle East. Retrieved November 27, 2024.
Open source URL - [26]MalwareBytes Ngrok February 2020
Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020.
Open source URL - [27]Zdnet Ngrok September 2018
Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.
Open source URL - [28]Zdnet Ngrok September 2018
Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.
Open source URL - [29]Microsoft SharePoint Exploit JUL 2025
Microsoft Threat Intelligence. (2025, July 22). Disrupting active exploitation of on-premises SharePoint vulnerabilities. Retrieved October 15, 2025.
Open source URL - [30]MalwareBytes Ngrok February 2020
Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020.
Open source URL - [31]MalwareBytes Ngrok February 2020
Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020.
Open source URL - [32]Cadet Blizzard emerges as novel threat actor
Microsoft Threat Intelligence. (2023, June 14). Cadet Blizzard emerges as a novel and distinct Russian threat actor. Retrieved July 10, 2023.
Open source URL - [33]CISA Scattered Spider Advisory November 2023
CISA. (2023, November 16). Cybersecurity Advisory: Scattered Spider (AA23-320A). Retrieved March 18, 2024.
Open source URL - [34]Check Point Scattered Spider JUL 2025
Check Point Team. (2025, July 7). Exposing Scattered Spider: New Indicators Highlight Growing Threat to Enterprises and Aviation. Retrieved October 13, 2025.
Open source URL - [35]CrowdStrike Scattered Spider JUL 2025
Counter Adversary Operations. (2025, July 2). CrowdStrike Services Observes SCATTERED SPIDER Escalate Attacks Across Industries. Retrieved October 13, 2025.
Open source URL - [36]Zdnet Ngrok September 2018
Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.
Open source URL - [37]Zdnet Ngrok September 2018
Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.
Open source URL - [38]Zdnet Ngrok September 2018
Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.
Open source URL - [39]Zdnet Ngrok September 2018
Cimpanu, C. (2018, September 13). Sly malware author hides cryptomining botnet behind ever-shifting proxy service. Retrieved September 15, 2020.
Open source URL - [40]MalwareBytes LazyScripter Feb 2021
Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.
Open source URL - [41]MalwareBytes LazyScripter Feb 2021
Jazi, H. (2021, February). LazyScripter: From Empire to double RAT. Retrieved November 17, 2024.
Open source URL - [42]Cyware Ngrok May 2019
Cyware. (2019, May 29). Cyber attackers leverage tunneling service to drop Lokibot onto victims’ systems. Retrieved September 15, 2020.
Open source URL - [43]Cyware Ngrok May 2019
Cyware. (2019, May 29). Cyber attackers leverage tunneling service to drop Lokibot onto victims’ systems. Retrieved September 15, 2020.
Open source URL - [44]FireEye Maze May 2020
Kennelly, J., Goody, K., Shilko, J. (2020, May 7). Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents. Retrieved May 18, 2020.
Open source URL - [45]FireEye Maze May 2020
Kennelly, J., Goody, K., Shilko, J. (2020, May 7). Navigating the MAZE: Tactics, Techniques and Procedures Associated With MAZE Ransomware Incidents. Retrieved May 18, 2020.
Open source URL - [46]MalwareBytes Ngrok February 2020
Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020.
Open source URL - [47]MalwareBytes Ngrok February 2020
Segura, J. (2020, February 26). Fraudsters cloak credit card skimmer with fake content delivery network, ngrok server. Retrieved September 15, 2020.
Open source URL - [48]Trend Micro Ngrok September 2020
Borja, A. Camba, A. et al (2020, September 14). Analysis of a Convoluted Attack Chain Involving Ngrok. Retrieved September 15, 2020.
Open source URL - [49]CrowdStrike PIONEER KITTEN August 2020
Orleans, A. (2020, August 31). Who Is PIONEER KITTEN?. Retrieved December 21, 2020.
Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.