Outbound TLS connection to ngrok.io tunnel used for netcat-based secret exfiltration

Emiliano Mema@Nosalva

•updated Jul 16, 2026•0•0•4

Detects outbound network traffic established to an *.ngrok.io domain, which is frequently used by adversaries to create secure tunnels for command and control (C2) or unauthorized data exfiltration.