I published the following diary on isc.sans.edu: “Python Backdoor Talking to a C2 Through Ngrok“:
I spotted a malicious Python script that implements a backdoor. The interesting behavior is the use of Ngrok to connect to the C2 server. Ngrok has been used for a while by attackers. Like most services available on the Internet, it has been abused by attackers for a long time. If you’re not familiar with Ngrok, here is the principle: You download the Ngrok client and publish your services (ex: a web server) in the wild. Ngrok acts like a reverse-proxy and allows access to your published services. Because Ngrok is very popular, it’s often not considered as harmful and is allowed to bypass firewalls, NAT, etc… [Read more]
The post [SANS ISC] Python Backdoor Talking to a C2 Through Ngrok appeared first on /dev/random.
Article Link: https://blog.rootshell.be/2020/12/10/sans-isc-python-backdoor-talking-to-a-c2-through-ngrok/