NGROK / Ligolo

This is a defensive tool-intelligence page. It is intended for analyst navigation, source review, and hunt planning. It is not a malware-analysis report and does not contain sample code or binaries.

Summary

• Associated actor(s): Pioneer Kitten
• Tool type(s): Tunneling / proxy tooling
• Confidence level(s): High
• Source ID(s): SRC-CISA-AA24-241A

Behavior

Actor	Behavior Summary
Pioneer Kitten	Dual-use tunneling tools used after edge compromise in Pioneer Kitten / Fox Kitten reporting.

Hash And IOC Status

Actor	Status	Reference
Pioneer Kitten	No malware hash; monitor tool binary, process, account, and network usage against approved admin list.	SRC-CISA-AA24-241A

Hashes and IOCs on this page are source pointers or representative public indicators. They SHOULD be refreshed from the linked source before operational use and MUST NOT be used alone for actor attribution.

Defensive Hunting Notes

Actor	Hunting Notes
Pioneer Kitten	Hunt unauthorized tunnels from edge servers, VPN appliances, or administrator workstations.

Handling Notes

Actor	Handling Notes
Pioneer Kitten	Dual-use; require local allowlisting.

Crosslinks

• Pioneer Kitten: profile, workbench, tool matrix
• Detection status: Detection Status Dashboard
• Hunt workflow: Hunt Workflow

Mapped ATT&CK Techniques For Associated Actor(s)

Actor	Technique	Tactic	Mapping Quality	Source
Pioneer Kitten	T1190 Exploit Public-Facing Application	Initial Access	M2	SRC-CISA-AA24-241A
Pioneer Kitten	T1219 Remote Access Software	Command and Control	M2	SRC-CISA-AA24-241A
Pioneer Kitten	T1572 Protocol Tunneling	Command and Control	M2	SRC-CISA-AA24-241A

Related Actor-Level Repository Detections

These detections are mapped through the associated actor or scenario and are not automatically tool-specific. Promote a tool-specific detection only after the behavior is tied to telemetry and test evidence.

Actor	Detection	Release Status	DRL	Rule
Pioneer Kitten	DET-002 - Suspicious RMM Installer Download From User Context	Pilot	6	detections/sigma/suspicious-rmm-file-sharing-download.yml
Pioneer Kitten	DET-003 - Unitronics PLC HMI Web Interface Access	Hunt	4	detections/sigma/unitronics-plc-hmi-web-access.yml

Related Actor-Level Hunts

These hunts are mapped through the associated actor or scenario and may need narrowing before they are used for this specific tool.

Actor	Hunt	Hypothesis	Query
Pioneer Kitten	HUNT-002	If MuddyWater-style RMM abuse is active then unauthorized RMM execution will appear from user-controlled paths	detections/kql/suspicious-rmm-file-sharing-download.kql
Pioneer Kitten	HUNT-003	If exposed PLC/HMI surfaces are targeted then OT management paths or ports will show external access	detections/sigma/unitronics-plc-hmi-web-access.yml

Source Review

Source	Publisher	Date	Reliability	Type	Last Reviewed
SRC-CISA-AA24-241A	FBI / CISA / DC3	2024-08-28	A	Government advisory	2026-05-14

If a source publishes a large or frequently changing IOC appendix, keep the current IOC list in the source system or TIP and store only the pointer here.