🧰 ngrok

The items that name it 7

• CikaBika Bot RAT Uses Discord for C&C
  article2026-10-15It is written here as Ngrok (legitimate service abused to exfiltrate ZIP archives).

  legitimate service abused to exfiltrate ZIP archives

• Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | Huntress
  writeup2026-10-06

  Tunneling utility noted by CISA as used by Akira affiliates to establish C2 communications and bypass perimeter monitoring

• The First 24 Hours: What Happens When Ransomware Lands
  writeup2026-10-02

  Named in CISA's Akira advisory as used for tunneling

• Grand Theft Auto VI hype leads to malware
  writeup2026-09-09

  Secure tunneling service abused by NJRAT for command-and-control (connects to 7.tcp.eu.ngrok[.]io:12684).

• Field Notes: NSSM - the Non-Sucking Service Manager
  writeup2026-07-27

  Legitimate tunneling utility, used in this case by attackers to tunnel protocols out of a network and expose internal services (like RDP or VNC) to the internet, run persistently via NSSM

• AWS Kiro RCE: Prompt Injection to Code Execution | Kodem
  writeup2026-07-19

  Used in the PoC to expose the local malicious server so Kiro would fetch it as an unfamiliar external site

• Socket: Coordinated npm/PyPI Campaign Typosquats Paysafe, Skrill, Neteller Payment SDKs
  writeup2026-07-16

  Used by the threat actor as C2 infrastructure/tunneling service (caliber-spinner-finishing.ngrok-free.dev) to receive exfiltrated data