AhnLab reports that attackers often install proxy tools after compromise to reach infected systems by RDP when the systems sit behind NAT. The Korean-language article cites Ngrok, Plink, and custom proxy tools, including Kimsuky and Andariel cases where operators exposed port 3389 for remote desktop control. It also notes an Andariel proxy tool that matched Lazarus tooling from 2021 and Kimsuky samples where proxy tools were newly identified across attacks. The defensive value is endpoint telemetry for Ngrok, Plink, and suspicious proxy execution that can reveal remote control and persistence activity before attackers deepen access.