Twingate is a hosted zero-trust remote access service that connects clients to private resources through Twingate Connectors deployed inside a network, without exposing inbound ports. Threat actors, notably Scattered Spider/UNC3944 and Octo Tempest, have been observed deploying Twingate Connectors on compromised networks to establish persistent remote access into internal environments.
Configures the Twingate client on a host, authenticating it to a Twingate network so the host can reach private resources published through Connectors.
twingate setupStarts the Twingate client and establishes the tunnel to the Twingate network, giving the host access to internal resources over the internet.
twingate startDeploys a Twingate Connector inside a network. A threat actor with a foothold can deploy a Connector to publish internal resources to their own Twingate tenant and reach them remotely.
docker run twingate/connector