.. /Portmap.io
Star

Access

Portmap.io is a hosted tunneling and port-forwarding service that exposes services behind NAT or a firewall to the internet through *.portmap.io hostnames over an OpenVPN connection. It has been repeatedly observed as attacker infrastructure, providing free *.portmap.io subdomains used as command-and-control endpoints by malware such as Pekraut, LodaRAT and SpyNote, and by APT19/Chimera.

Paths:

Resources:

Detections:

Access

  1. Connects the local host to the Portmap.io network using the OpenVPN configuration downloaded from the Portmap.io dashboard, after which configured mappings forward a public *.portmap.io host and port to a local service.

    openvpn <config>.ovpn
    Use case
    Establishing the Portmap.io tunnel to expose a local service.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS

  2. A port mapping configured in the Portmap.io web dashboard forwards a public port on a *.portmap.io host to a local service, reachable from anywhere on the internet.

    <mapping via dashboard>: 4433 -> 127.0.0.1:4433
    Use case
    Exposing a local service such as a C2 listener or RAT over the internet.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS