Attackers Abused Ngrok to Expose RDP and VNC for Persistent Access
Summary
Huntress describes finding a Windows foothold where attackers used ngrok tunnels to expose RDP and VNC, with a renamed client, hidden script, and persistent UltraVNC server.
Key points
- Huntress found evidence of an attacker foothold on a victim's Windows computer using ngrok to tunnel services to the public internet.
- A VBScript launched PowerShell with a hidden window to run a renamed ngrok binary, conhost.exe, using a configuration file and the EU region.
- The ngrok configuration exposed RDP on port 3389, VNC on port 6300, and a possible Squid or HTTP proxy on port 3128.
- An UltraVNC server named winvnc.exe was stored in a user's AppData Chrome folder and configured to persist through a Windows Registry Run key.
- The VNC configuration confirmed port 6300 and enabled file transfer; Huntress warned that exposed remote-access services could support continued access and potentially lateral movement or data exfiltration.
- The article recommends monitoring outbound traffic and endpoint processes, logging, and application allowlisting to help identify or restrict unauthorized ngrok use.
Article Details
- Attack Vectors
- A VBScript launches PowerShell with a hidden window, then starts a renamed ngrok executable using a configuration file that exposes RDP on port 3389, VNC on port 6300, and a possible Squid or HTTP proxy on port 3128.
- A VNC server identified as UltraVNC was placed in a user's AppData Chrome folder and configured to listen on port 6300.
- A Windows Registry Run key named WindNT was used to keep the VNC server running at user logon.
- Defensive Notes
- Monitor and log outbound traffic and connections to unauthorized ngrok endpoints.
- Inspect endpoints for unauthorized ngrok processes and suspicious process activity; use application allowlisting to restrict unwanted applications.
- Review internet-exposed RDP and other remote-control services, including VNC, and check for unexpected listeners on non-standard ports.
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolThe ngrok configuration exposes the victim's RDP service on port 3389 for remote access.T1021.005 · VNCThe ngrok configuration exposes the victim's VNC service on port 6300 for remote desktop access.T1036.003 · Rename Legitimate UtilitiesThe ngrok executable is renamed conhost.exe to resemble a legitimate Windows process.T1059.001 · PowerShellThe VBScript launches PowerShell with a hidden-window option to start the renamed ngrok executable.T1059.005 · Visual BasicA VBScript uses WScript.Shell to run the command that starts the attacker-configured ngrok process.T1547.001 · Registry Run Keys / Startup FolderA Windows Registry Run key named WindNT starts the VNC server at user logon.T1564.003 · Hidden WindowPowerShell is launched with -windowstyle hidden.T1572 · Protocol TunnelingNgrok tunnels traffic from the victim host's RDP, VNC, and possible proxy ports to the public Internet.