1200KM / tool
ngrok — Attack Tool
ngrok is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. ngrok has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: ngrok
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- OilRig · G0049 · Pinned relationship source (relationship--392d928f-a05b-42d3-9294-bc0f074a30b2)
- Fox Kitten · G0117 · Pinned relationship source (relationship--d18f30d7-deca-457c-b993-c87843ae3bab)
- LazyScripter · G0140 · Pinned relationship source (relationship--b3a2df5e-af39-4129-a63c-7dee0e5986bb)
- Ember Bear · G1003 · Pinned relationship source (relationship--9b88e4d5-7a81-4167-95b3-63b10d88ea29)
- Scattered Spider · G1015 · Pinned relationship source (relationship--a24aad94-40e4-43a4-b2a4-ed8bfd412dcb)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.