Do Son 
At a Glance
- Malware family: Multiple families including ModeloRAT, EtherRAT, AsukaStealer, and C2Looper
- Threat actor: Suspected initial access broker Woodgnat (KongTuke) and unnamed cybercrime groups
- Target or victims: Technology firms, fintech companies, hotels, and government agencies
- Delivery vector: ClickFix fake update prompts and malicious PowerShell commands
- Key capabilities: Living-off-the-land execution, registry persistence, and blockchain-based EtherHiding
- Source: Symantec Threat Hunter Team and Zscaler
TL;DR
Attackers are abusing the legitimate Node.js runtime to bypass endpoint defenses across global networks. The Symantec Threat Hunter Team observed multiple campaigns deploying Node.js malware since February 2026. These intrusions hit technology companies, hotels, and financial institutions while establishing stealthy footholds linked to ransomware groups.
Delivery
Threat actors frequently initiate these intrusions through social engineering schemes known as ClickFix lures. Victims encounter deceptive web prompts that instruct them to copy and paste code into the Windows Run dialog. In several cases, this action executes a hidden PowerShell command that downloads a secondary script.
Furthermore, the attackers install the legitimate Node.js developer package directly from official project repositories. In an intrusion at an Asian technology company, security software repeatedly blocked standard penetration testing tools. Therefore, the intruders downloaded the official software installer directly to the target machine.
The attackers adopt this tactic because the runtime executable carries a valid digital signature. As Symantec researchers observed, “The technique’s appeal is that node.exe (the binary that runs Node.js) is a legitimate, signed developer tool.” Consequently, security software often permits the binary to run without generating immediate alerts.
Infection Chain
The intrusion chain begins with initial command execution via PowerShell. Once running on the host, the script configures itself to launch as a persistent background service. Next, the script attempts to download additional command frameworks.
However, modern endpoint security tools often detect and terminate common binary payloads like Cobalt Strike. When their standard tools failed, the attackers adapted their strategy. They deployed a native addon alongside the signed runtime to handle system interactions. Then, the intruders created a Windows registry Run key.
This registry entry restarts the runtime through a headless console session at every user login. The signed binary executes an encrypted data file containing the core malicious code. Because the logic resides in interpreted scripts rather than a standalone binary, traditional signature scanners miss the payload.
Meanwhile, related intrusions show threat actors deploying alternative backdoors. At a United States fintech company, the same infrastructure delivered a Rust-based tool known as C2Looper. Security researchers at Zscaler previously documented this implant as a precursor to ransomware deployments.
Command-and-Control and Data-Exfiltration Behaviour
Once established on a system, the Node.js malware connects to external command channels. In the Asian technology intrusion, the implant contacted Ethereum blockchain gateway services roughly once per day. The operators use this technique, known as EtherHiding, to conceal communication addresses inside public smart contracts.
Subsequently, the implant transferred communication to cloud-hosted serverless worker domains. The threat actors also spoofed legitimate software companies to blend their network traffic with routine business data. Analysts noted, “The intrusion is one of many involving Node.js in recent months and provides a clear illustration of why Node.js abuse, an old and well-documented technique, has returned to favor among attackers.”
Additionally, other threat actors deploy information stealers using the same runtime framework. For instance, campaigns in May 2026 targeted hotels across Asia with a JavaScript version of AsukaStealer. That malware family harvests stored browser credentials, session cookies, and cryptocurrency wallet keys. Suspected access broker Woodgnat also links to ModeloRAT, a tool connected to major extortion groups like Qilin and Black Basta.
Defense or Detection Guidance
Defenders must adapt their monitoring strategies to catch interpreted script threats. First, security teams should track unexpected installations of developer tools on corporate workstations. Most business endpoints have no genuine operational need for standalone scripting engines.
Furthermore, organizations must monitor Windows registry Run keys for commands calling console binaries in headless modes. Track child processes spawned by script interpreters, especially when they initiate outbound web connections. Finally, inspect network traffic for repeated requests to public blockchain RPC gateways and unusual serverless worker domains.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
