Proxy Tools Detected by AhnLab EDR

This AhnLab report documents how threat actors leverage tunneling/proxy tools (Ngrok, Plink, and custom proxy binaries) to expose RDP services behind NAT for remote access, persistence, and screen control; it provides observed commands and examples involving Kimsuky, Andariel, Lazarus and LockBit-related activity and shows how AhnLab EDR detects and classifies these behaviors.