Cloudflared Utility Used as Covert Tunneling Tool
Cloudflared, a legitimate Cloudflare tunneling utility, was used by attackers to establish covert outbound connections and disguise malicious traffic in N-able N-central…
Tag: tunneling
MiniFast: Tunneling Tool (aka MiniUpdate, Retrograde)
MiniFast, also known as MiniUpdate and Retrograde, is a tunneling tool with functional overlaps to BridgeHead, used by Nimbus Manticore.
LIGHTRAIL: Tunneling Utility Used by Nimbus Manticore
LIGHTRAIL is a bespoke tunneling utility previously used by Nimbus Manticore, part of the group's continued reliance on tunneling tools.
POLLBLEND: Tunneling Utility Used by Nimbus Manticore
POLLBLEND is a bespoke tunneling utility previously used by Nimbus Manticore, part of the group's continued reliance on tunneling tools.
GSocket: Open-Source Tunneling Toolkit Used in ClickLock
GSocket is an open-source tunneling toolkit that provides encrypted reverse backdoor capabilities. Its gs-netcat component was copied in the ClickLock Stealer's goyim…
The Hacker’s Choice: Developer of GSocket Toolkit
The Hacker's Choice is the developer of the GSocket open-source tunneling toolkit, which was copied in the ClickLock Stealer's goyim backdoor.
Mercury Workshop: Developer of Wisp Protocol
Mercury Workshop is the developer of the Wisp protocol, a low-overhead protocol for tunneling many TCP and UDP sockets over a single…
Teleport Tunneling Tool Used in Scattered Spider Attack
Attackers used Teleport, a second tunneling tool, alongside ngrok during the May 2025 intrusion at a luxury jewelry retailer attributed to Scattered…
Go2Tunnel: Remote Access and Tunneling Tool
Go2Tunnel is a tool for establishing reverse SSH tunnels, used by Armored Likho and integrated into BusySnake Stealer.
Ngrok
Ngrok is a tool that creates secure tunnels to localhost. Qilin ransomware affiliates used Ngrok for remote access and reconnaissance during intrusions…