4 ms·

I don't understand why this is news for anybody. This is just the cloudflare version of ngrok...

• deleted 3y ago
  [deleted]
• TechBro8615 3y ago
  It's a bit more pernicious than ngrok just because it's more difficult to isolate and block only malicious usage of the feature. But yeah I agree it's not breaking news that implants will find ways to tunnel out of your infrastructure when exfiltrating data...
• neodymiumphish 3y ago
  Doesn't ngrok require a local config? This technique allows attackers to maintain a nonfunctional tunnel and enable functionality only when they want to engage with the victim machine, similar to TA569's SocGholish campaigns across news sites last year.