Node.js: Old Technique Makes a Comeback

This threat involves a resurgence of Node.js abuse observed since early 2026, where attackers leverage the legitimate node.exe binary to run malicious JavaScript payloads, evading signature-based defenses. The threat actors have targeted government departments, technology companies, and hotels. In one case, attackers downloaded the official Node.js installer after repeated payload blocks to run implants communicating with Ethereum blockchain gateways using EtherHiding techniques. Another incident involved deploying the Rust-based C2Looper backdoor linked to ransomware operations at a U.S. fintech firm. Multiple attacks feature ModeloRAT, linked to the initial access broker Woodgnat, which is connected to ransomware families including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo. The attackers use ClickFix techniques for initial access and combine living-off-the-land tools with commodity malware to maintain persistence and evade detection.

The threat enables attackers to bypass signature-based detection by abusing a legitimate signed binary (node.exe) to execute malicious payloads. This facilitates initial access, persistence, and command-and-control communications, including covert channels via Ethereum blockchain gateways. The involvement of backdoors like C2Looper and malware such as ModeloRAT linked to multiple ransomware families indicates a high risk of ransomware deployment and data compromise in targeted organizations.

No specific patch or official fix is indicated for this threat. Mitigation should focus on detecting and blocking abuse of legitimate binaries like node.exe, monitoring for unusual Node.js installer downloads and executions, and identifying behaviors associated with ModeloRAT, C2Looper, and related ransomware activity. Organizations should apply threat intelligence to detect ClickFix techniques and living-off-the-land tool usage. Since this is a technique abuse rather than a software vulnerability, standard patching does not apply. Continuous monitoring and behavioral detection are recommended.