Node.js Old Technique Makes a Comeback
Node.js: Old Technique Makes a Comeback 🚀
Abuse of Node.js has undergone a revival. The Symantec Threat Hunter Team has observed this technique being used by multiple actors since February 2026, with victims including government departments, technology companies, and hotels. The appeal of this technique lies in the fact that node.exe (the binary that runs Node.js) is a legitimate, signed developer tool. The attacker’s malicious code resides in interpreted scripts rather than in a binary, making it less likely to trigger signature-based detection. Additionally, a registry Run key entry can relaunch the payload at every login.
Node.js is an open-source, cross-platform JavaScript runtime environment that attackers are abusing for persistence and execution because it is a trusted, signed script interpreter.
Recent Intrusions 🔍
In one intrusion at an Asian technology company, attackers whose payloads were repeatedly blocked downloaded the official Node.js installer and used the runtime to execute an implant that contacted Ethereum blockchain gateways. This technique, known as EtherHiding, was likely used to retrieve commands or payloads hidden in a smart contract. This intrusion, which occurred between March and July 2026, illustrates why Node.js abuse, an old and well-documented technique, has returned to favor among attackers. The implant maintained its foothold for months and made repeated connections to Ethereum blockchain gateways.
The same attackers also compromised a U.S. fintech company using a similar attack chain, deploying a Rust-based backdoor known as C2Looper, which has been linked to ransomware attacks. This Rust-based backdoor was previously documented by Zscaler in a blog in August 2026, where they described it as “a new malware family likely used in ransomware attacks to establish a foothold for lateral movement.” One of the C2Looper C&C indicators (45.158.196.23:8888) matches a C&C and port used in the attack on the U.S. fintech company, indicating that this attack and the Zscaler-documented attack were likely carried out by the same actor.
Techniques and Tools 🛠️
In some of the attacks seen since February 2026, the technique was used alongside ModeloRAT, believed to be developed by an initial access broker called Woodgnat (aka KongTuke). Woodgnat has been publicly linked to attacks involving multiple ransomware families, including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo. Node.js was also used in a recent attack that the Symantec Threat Hunter Team blogged about, in which a new backdoor called Backdoor.Mistic was deployed. This backdoor may also be developed by Woodgnat.