ngrok
- ID
- S0508
- Type
- Tool
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 17 Oct 2025
ngrok is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. ngrok has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration.[1][2][3][4]
Techniques used (5)
- T1090 Proxy
- T1102 Web Service
- T1567 Exfiltration Over Web Service
- T1568.002 Domain Generation Algorithms
- T1572 Protocol Tunneling