Full Report
The trusted JavaScript runtime has featured in multiple attacks since February 2026, some linked to ransomware. In one case, attackers installed it from its official site to run an implant commanded via the Ethereum blockchain.
Analysis Summary
# Morning News Roll-up September 3, 2026
## Overview
Recent threat intelligence highlights a resurgence in the abuse of the Node.js runtime environment by sophisticated threat actors to bypass security detections. By using the legitimate, signed `node.exe` binary to execute malicious JavaScript-based implants, attackers are successfully evading signature-based tools. These campaigns, observed since February 2026, involve novel command-and-control (C2) techniques such as "EtherHiding" via the Ethereum blockchain and are frequently linked to ransomware initial access brokers.
## Top Stories
### Node.js Abuse: Old Technique Makes a Comeback
- Summary: Attackers are increasingly downloading official Node.js installers to run malicious interpreted scripts. This allows them to hide malicious logic within scripts rather than binaries, utilizing a trusted developer tool for persistence and execution.
- Source: hxxps://www[.]security[.]com/threat-intelligence/node-js-returns-ransomware
# Node.js Exploitation and EtherHiding Campaign
## Key Points
- **Resurgence of Node.js Abuse:** The legitimate Node.js runtime (`node.exe`) is being used as a "Living off the Land" binary (LoLBins) to execute malicious JavaScript implants.
- **EtherHiding Technique:** Attackers are using Node.js implants to communicate with Ethereum blockchain gateways. This facilitates retrieving malicious commands or payloads stored within blockchain smart contracts.
- **Evasion Tactics:** Because `node.exe` is a signed, trusted binary, the malicious activity occurs in interpreted memory/scripts, which often bypasses traditional signature-based antivirus and EDR solutions.
- **Persistence:** Attackers establish persistence by adding Node.js commands to registry Run keys, ensuring the malicious script executes at every user login.
## Threat Actors
- **Woodgnat (aka KongTuke):** Identified as a prominent initial access broker (IAB).
- **Affiliations:** Linked to multiple ransomware families including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo.
- **Motivations:** Primarily financial, serving as a gateway for ransomware deployment.
## TTPs
- **Initial Access:** Use of the "ClickFix" technique (social engineering users to run malicious code under the guise of fixing browser issues).
- **Execution:** Deployment of the official Node.js installer followed by execution of JavaScript-based implants.
- **Command and Control:**
- Use of the **C2Looper** Rust-based backdoor.
- **EtherHiding:** Leveraging Ethereum blockchain gateways for stealthy C2 communication.
- **Lateral Movement/Persistence:** PowerShell scripts, AdaptixC2 agents, Cobalt Strike Beacons, and Registry Run keys.
## Affected Systems
- **Target Industries:** Government departments, technology companies, hotels, and fintech organizations.
- **Geographies:** Noted impacts in Asia and the United States.
- **Platforms:** Windows systems (leveraging `node.exe` and registry keys).
## Mitigations
- **Binary Whitelisting:** Monitor or restrict the execution of `node.exe` in environments where it is not required for legitimate development work.
- **Registry Monitoring:** Audit and alert on new entries in `HKCU\Software\Microsoft\Windows\CurrentVersion\Run` and `HKLM` equivalents that call `node.exe`.
- **Network Filtering:** Block or monitor traffic to known blockchain gateways (e.g., Ethereum gateways) if there is no legitimate business case for such traffic.
- **Behavioral Analysis:** Implement EDR rules to detect `node.exe` spawning shells (PowerShell/CMD) or making unusual outbound external network connections.
## IoCs
- **Domains:**
- video[.]technodatabase[.]net
- api[.]technodatabase[.]net
- summonhood[.]com
- chat[.]devminelimited[.]com
- docs[.]datalayerservice[.]com
- srv[.]doctecsolutions[.]com
- authorized-logins[.]net
- **URLs:**
- hxxp://178[.]16[.]54[.]253/~extranet/Tmsyz[.]exe
- hxxp://193[.]58[.]122[.]42/files/hvnc2[.]exe
- hxxps://toogwido[.]sa[.]com/Ca[.]ps1
- hxxp://thomphon[.]com/update[.]msi
- **Associated Tools:** ModeloRAT, Backdoor.Mistic, C2Looper, AdaptixC2.
## Conclusion
The revival of Node.js abuse represents a strategic shift by access brokers to counter improved binary detection. By wrapping malicious logic in interpreted scripts managed by a trusted runtime, actors like Woodgnat are successfully delivering ransomware payloads. Organizations should prioritize monitoring the use of developer tools on non-developer workstations and scrutinize unusual blockchain-related network activity.