Abusing Ngrok: Hackers at the End of the Tunnel

Huntress reports an incident in which attackers installed a renamed ngrok client (masquerading as conhost.exe) and used a persistent VBScript to launch it with an ngrok configuration exposing RDP (3389), UltraVNC (configured on port 6300), and a proxy (3128) to the public Internet. Artifacts recovered include the ngrok.yml, an UltraVNC configuration and winvnc.exe in a user AppData folder plus registry Run keys, indicating post-exploitation persistence and remote access capabilities that could enable full desktop control, lateral movement, and data exfiltration.