T1572

Protocol Tunneling

discovered 2026-07-07

C2 fronted by an ngrok free-tier tunnel (caliber-spinner-finishing.ngrok-free.dev), hiding the backing host behind a trusted tunneling provider.

View on MITRE ATT&CK

Seen in packages