# Localhost tunnel abuse ledger > 11 published reports, from 2021 to 2026, of criminals using ngrok and Cloudflare tunnels for malware delivery, phishing, and ransomware. Source: https://layerv.ai/research/tunnel-abuse-ledger/ --- [← All research](https://layerv.ai/research/) # Localhost tunnel abuse ledger 11 published reports, from 2021 to 2026, of criminals using ngrok and Cloudflare tunnels for malware delivery, phishing, and ransomware. Updated October 1, 2026. Licensed CC BY 4.0. [Download JSON ↓](https://layerv.ai/data/tunnel-abuse-ledger/ledger.json) 11 verified reports 9 name Cloudflare tunnels 6 name ngrok ## Reports, newest first Each report was read at its original URL. Dates are the publication date shown on the page. Summaries are paraphrased; malware families, sectors, and scale are listed only where the report states them, otherwise left out. ### [Beyond the ransomware: Tracking Storm-2570’s consistent tradecraft across deployments](https://www.microsoft.com/en-us/security/blog/2026/09/24/beyond-ransomware-tracking-storm-2570-consistent-tradecraft-across-deployments/) 2026-09-24 · Microsoft Threat Intelligence Microsoft describes a ransomware affiliate that installed cloudflared as a persistent service for outbound access and used ngrok to expose RDP before moving laterally and deploying ransomware from several brands. Tunnels named - Cloudflare Tunnel (cloudflared) - ngrok Malware Qilin, DragonForce, Anubis, BERT Sectors healthcare and public health, education, government, financial services, energy, consumer retail, information technology, food and agriculture, consumer services, commercial facilities, non-government organizations, chemicals, critical manufacturing, transportation Scale, as reported Multiple intrusions in the US, Canada, UK, Spain, the Netherlands, and Puerto Rico; actor tracked since April 2025 ### [Threat Actors Increasingly Abuse Cloudflare Quick Tunnels for Malware Distribution and Post-Compromise Operations](https://us.zurichresilience.com/cybersecurity/articles-and-insights/insights/security-event-bulletins/threat-actors-increasingly-abuse-cloudflare-quick-tunnels) 2026-08-25 · SpearTip (Zurich Resilience Solutions) SpearTip's SOC reports attackers using throwaway trycloudflare.com subdomains across several investigations to host malware and tooling, receive uploads, and support post-compromise steps such as hidden admin accounts and attempts to enable RDP. Tunnels named - Cloudflare Quick Tunnels (trycloudflare.com) - ngrok Scale, as reported Multiple investigations; 8 malicious quick tunnel subdomains listed ### [The Unintentional Enabler: How Cloudflare Services are Abused for Credential Theft and Malware Distribution](https://cofense.com/blog/how-cloudflare-services-are-abused-for-credential-theft-and-malware-distribution) 2026-03-25 · Cofense Cofense Intelligence reviews how attackers use Cloudflare Workers for credential phishing pages and TryCloudflare tunnels to deliver remote access trojans. Tunnels named - Cloudflare Quick Tunnels (TryCloudflare) Malware Xeno RAT, XWorm Scale, as reported Cofense's incident data shows 2025 as the peak year for Cloudflare Tunnels and Workers abuse since its tracking began in 2021 ### [Analyzing SERPENTINE#CLOUD: Threat Actors Abuse Cloudflare Tunnels to Infect Systems with Stealthy Python-Based Malware](https://www.securonix.com/blog/analyzing%5Fserpentinecloud-threat-actors-abuse-cloudflare-tunnels-threat-research/) 2025-06-18 · Securonix Securonix traces a phishing campaign in which shortcut files pulled scripts over WebDAV from trycloudflare.com subdomains, ending in an in-memory loader for remote access trojans. Tunnels named - Cloudflare Quick Tunnels (trycloudflare.com) Malware AsyncRAT, RevengeRAT ### [Threat Actor Abuses Cloudflare Tunnels to Deliver RATs](https://www.proofpoint.com/us/blog/threat-insight/threat-actor-abuses-cloudflare-tunnels-deliver-rats) 2024-08-01 · Proofpoint Proofpoint tracked a financially motivated cluster, active since February 2024, that used account-less TryCloudflare tunnels to host WebDAV payloads that installed remote access trojans. Tunnels named - Cloudflare Quick Tunnels (TryCloudflare) Malware Xworm, AsyncRAT, VenomRAT, GuLoader, Remcos Sectors law, finance, manufacturing, technology Scale, as reported Hundreds to tens of thousands of messages per campaign; one July 2024 campaign sent over 1,500 messages ### [Quartet of Trouble: XWorm, AsyncRAT, VenomRAT, and PureLogs Stealer Leverage TryCloudflare](https://www.esentire.com/blog/quartet-of-trouble-xworm-asyncrat-venomrat-and-purelogs-stealer-leverage-trycloudflare) 2024-07-31 · eSentire Threat Response Unit eSentire responded to an infection at a government-sector customer where a phishing chain fetched payloads from a WebDAV server behind TryCloudflare and installed four malware families. Tunnels named - Cloudflare Quick Tunnels (TryCloudflare) Malware XWorm, AsyncRAT, VenomRAT, PureLogs Stealer Sectors government Scale, as reported One customer infection, July 2024 ### [TCP endpoints now require a valid payment card](https://ngrok.com/blog/tcp-endpoints-require-verification) 2024-06-13 · ngrok ngrok began requiring a payment card for TCP endpoints after a sharp rise, from March 2024, in reports that its agent was being used in malware campaigns. Tunnels named - ngrok Scale, as reported ngrok says 14 of 65 VirusTotal vendors wrongly flagged its agent binary ### [#StopRansomware: Akira Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a) 2024-04-18 · CISA, FBI, Europol EC3, and NCSC-NL The joint advisory on Akira ransomware lists ngrok and Cloudflare Tunnel among the tools its operators use to move data out of victim networks; its November 2025 update adds ngrok-based encrypted command-and-control sessions. Tunnels named - ngrok - Cloudflare Tunnel (cloudflared) Malware Akira, Akira\_v2, Megazord Sectors education, critical manufacturing, information technology, healthcare and public health, financial services, food and agriculture Scale, as reported About $244 million in ransom proceeds as of late September 2025 (advisory update of November 13, 2025) ### [Tunnel Vision: CloudflareD AbuseD in the WilD](https://www.guidepointsecurity.com/blog/tunnel-vision-cloudflared-abused-in-the-wild/) 2023-08-03 · GuidePoint Security GuidePoint describes intruders running cloudflared on victim hosts for a persistent outbound tunnel that exposes services such as RDP, SSH, and SMB. Tunnels named - Cloudflare Tunnel (cloudflared) Scale, as reported Multiple incident response engagements (count not stated) ### [Cybercriminals Exploit Reverse Tunnel Services and URL Shorteners to Launch Large-Scale Phishing Campaigns](https://www.cloudsek.com/threatintelligence/cybercriminals-exploit-reverse-tunnel-services-and-url-shorteners-to-launch-large-scale-phishing-campaigns) 2022-06-22 · CloudSEK CloudSEK analyzed over 500 phishing sites served through reverse tunnel services behind URL shorteners, with customers of Indian banks a particular target, with attackers rotating the short-lived tunnel URLs. Tunnels named - ngrok - localhost.run - Cloudflare Quick Tunnels (Argo Tunnel) Sectors banking Scale, as reported More than 500 phishing sites analyzed ### [Ngrok Platform Abused by Hackers to Deliver a New Wave of Phishing Attacks](https://cyble.com/blog/ngrok-platform-abused-by-hackers-to-deliver-a-new-wave-of-phishing-attacks/) 2021-02-15 · Cyble Cyble reported a rise in phishing on random ngrok.io subdomains, including a shared phishing kit, and listed commodity remote access trojans it had seen tunnelling through ngrok. Tunnels named - ngrok Malware njRAT, DarkComet, Quasar RAT, AsyncRAT, NanoCore RAT Sectors financial institutions ## Sharing without a public tunnel URL Most of these reports describe attackers using free public hostnames under a trusted domain, and ngrok and Microsoft dev tunnels both describe their visitor warning pages as anti-phishing measures. See how tools compare on that in [every way to share localhost](https://layerv.ai/compare/localhost-tunnels/). ## Frequently Asked Questions Why do attackers use localhost tunnels? The reports describe three uses: hosting malware or phishing pages on a free, disposable hostname under a trusted domain; keeping an outbound path into a compromised network; and moving data out. Proofpoint points out that the TryCloudflare tunnels it tracked were created without an account. Should I block trycloudflare.com or ngrok on my network? SpearTip recommends blocking \*.trycloudflare.com where business needs allow, and the Akira advisory lists ngrok among the tools its operators use. Whether to block depends on whether your developers rely on those services. How are entries chosen? Each entry is a report by a security vendor, a government agency, or the tunnel provider itself, read at its original URL. We list malware, sectors, and scale only where the report states them. ## Cite this LayerV (2026). Localhost tunnel abuse ledger. https://layerv.ai/research/tunnel-abuse-ledger (updated 2026-10-01). CC BY 4.0. --- *This markdown version is auto-generated from [https://layerv.ai/research/tunnel-abuse-ledger/](https://layerv.ai/research/tunnel-abuse-ledger/) for AI agents. Curated agent resources: [llms.txt](https://layerv.ai/llms.txt). For the full interactive experience, visit the HTML version.*