[SANS ISC] Python Backdoor Talking to a C2 Through Ngrok

I published the following diary on isc.sans.edu: “Python Backdoor Talking to a C2 Through Ngrok“:

I spotted a malicious Python script that implements a backdoor. The interesting behavior is the use of Ngrok to connect to the C2 server. Ngrok has been used for a while by attackers. Like most services available on the Internet, it has been abused by attackers for a long time. If you’re not familiar with Ngrok, here is the principle: You download the Ngrok client and publish your services (ex: a web server) in the wild. Ngrok acts like a reverse-proxy and allows access to your published services. Because Ngrok is very popular, it’s often not considered as harmful and is allowed to bypass firewalls, NAT, etc… [Read more]