Threat reportMalwareTL-2026-1178
Malicious Windows Shortcuts (LNK) Deploy Node.js Backdoor via PowerShell and TON Blockchain C2 (EtherHiding-style)
Malicious Windows Shortcuts (LNK) Deploy Node.js Backdoor (TL-2026-1178) is a high-severity malware campaign, first published 2026-07-10. It has no confirmed attribution, affects Microsoft Windows (all supported client/server versions supporting, maps to 17 MITRE ATT&CK techniques (T1008, T1027, T1036.005), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 17MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-1178
- Threat ID
- TL-2026-1178
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- hospitality, travel, hotels
- Target regions
- Unspecified
- Detection rules
- 9
- Indicators of compromise
- 30
How Malicious Windows Shortcuts (LNK) Deploy Node.js Backdoor works
A multi-stage campaign uses Windows .LNK shortcut files disguised as images (photo-*.png.lnk, IMG-*.png.lnk) delivered via booking-themed spam and Google Share links targeting hotels and travel businesses. The LNK runs obfuscated PowerShell that downloads a legitimate Node.js v24.13.0 runtime, decrypts a VM-interpreter-based JavaScript backdoor, installs Registry Run-key persistence, attempts a Microsoft Defender exclusion, and resolves its live C2 domain by querying a TON blockchain smart contract (EtherHiding-style resilient C2).
The campaign begins with malicious ZIP archives containing .lnk files that borrow icons from shell32.dll to masquerade as image files (photo-*.png.lnk / IMG-*.png.lnk). Victims are lured via booking-themed spam email and shortened Google Share links (hxxps://share.google/YLoRYlokrW3iner8r) that redirect to attacker infrastructure (hxxps://recordstrace[.]info/5bC6vVOeP9PI3B08); early samples were also seeded as comments on public discussion/economics forums.
Double-clicking the LNK triggers an obfuscated PowerShell one-liner. Two obfuscation variants were identified: one using bitwise operations (-band 255, -shr 8) and one using arithmetic equivalents (modulo 256, integer division) to reconstruct the destination C2 hostname from encoded integers at runtime, keeping the true destination invisible in the shortcut's plaintext target field.
If Node.js is not already present, the PowerShell downloads the genuine, unmodified Node.js v24.13.0 Windows x64 distribution directly from nodejs.org (https://nodejs.org/dist/v24.13.0/node-v24.13.0-win-x64.zip), unpacks it under %LOCALAPPDATA%, then Base64-decodes and AES-128-CBC-decrypts an accompanying JavaScript payload. Abusing a legitimate, signed runtime as the execution host lowers the odds of AV/EDR flagging the process tree and is itself a masquerading technique (T1036.005).
The JavaScript payload is heavily scrambled and implements a custom bytecode virtual-machine interpreter (internally referenced as a vmn_c51b70-style function) that decodes and executes 32 Base64-encoded instruction blobs at runtime rather than running plain JavaScript logic, substantially hindering static analysis. The backdoor checks for and avoids duplicate execution, then installs persistence via an HKCU:\Software\Microsoft\Windows\CurrentVersion\Run registry value that relaunches node.exe detached, with its window hidden and stdout/stderr suppressed, on every logon. Before executing any additional downloaded binaries, the malware attempts to add a Windows Defender process exclusion via an Add-MpPreference -ExclusionProcess "<path>" command, disabling AV inspection of its own components.
For command-and-control, the backdoor does not hardcode a C2 domain. Instead it queries the TON blockchain via the public TONAPI service (https://tonapi.io/v2/blockchain/accounts/0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9/methods/get_domain) to retrieve the current, operator-controlled C2 hostname from smart-contract transaction data — an EtherHiding-style technique previously documented on BNB Smart Chain/Ethereum and now observed leveraging TON. Because the smart contract's stored value can be updated at any time by the operator without touching the malware binary itself, defenders cannot disrupt the campaign by seizing or sinkholing a single domain; historical contract transactions show the resolved domain rotating across dozens of throwaway domains (tonajukbhuakpo2[.]shop, zloapobikahy23[.]bond, hsaertyuoang34[.]sbs, amanohuguta[.]cfd, and 30+ others) between February and June 2026.
Once a live C2 hostname is resolved, the backdoor opens a WebSocket connection (wss://<c2>/w?user_id=<guid>), performs an ECDH secp256k1 key exchange with the server, and derives a shared AES-256-CBC key/IV via HKDF for subsequent encrypted command traffic — layering standard-port-agnostic WebSocket transport (T1571) on top of the blockchain-resolved fallback channel (T1008).
Security researchers (LevelBlue SpiderLabs) discovered the activity while investigating a customer alert and correlated more than 400 LNK samples back to a single shared MachineID value (win-5r0dsv23ed0), with the earliest samples dating to approximately March 2026 and new samples still appearing daily as of the July 2026 publication — indicating a large, ongoing, centrally operated campaign rather than isolated spam. Targeting is concentrated on hotels and travel/booking-related businesses via booking-themed lures, consistent with a financially-motivated initial-access or fraud operation, though no threat actor has been publicly attributed at this time.
MITRE ATT&CK techniques used in TL-2026-1178
Command and Control
T1008 Fallback Channels; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1571 Non-Standard Port; T1573.001 Symmetric Cryptography
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.001 Malicious Link; T1204.002 Malicious File
Persistence
T1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1547.001 Registry Run Keys / Startup Folder
Initial Access
T1566.001 Spearphishing Attachment; T1566.002 Spearphishing Link
defense-impairment
Affected products and versions in Malicious Windows Shortcuts (LNK) Deploy Node.js Backdoor
- Microsoft — Windows (all supported client/server versions supporting .lnk execution)
Vulnerable versions: All supported versions - Node.js Foundation — Node.js runtime v24.13.0 (abused as a living-off-the-land execution host; the runtime itself is not vulnerable)
- TON Foundation — TON blockchain public API (tonapi.io) — abused as a resilient C2 resolution channel, not itself compromised
Remediation for Malicious Windows Shortcuts (LNK) Deploy Node.js Backdoor
Immediate actions
- Block execution of .lnk files delivered as email attachments or extracted from ZIP archives from external/unverified senders
- Block or alert on outbound requests to tonapi.io and other TON blockchain API endpoints from standard user endpoints
- Hunt for and remove HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries that launch node.exe with hidden-window/detached arguments
- Hunt for unauthorized Node.js runtime installations under %LOCALAPPDATA% not deployed by IT
- Audit Microsoft Defender exclusion lists (Add-MpPreference history / Get-MpPreference -ExclusionProcess) for attacker-added process exclusions
- Block the known C2 and initial-access domains/URLs at email gateway, web proxy, and DNS layers
Workarounds
- Disable Windows Script Host / shortcut auto-execution policies for files originating from Downloads or email-extracted ZIP folders
- Restrict LocalAppData execution via AppLocker/WDAC for unsigned or newly-dropped node.exe binaries
Longer-term hardening
- Deploy EDR behavioral detection for PowerShell spawning node.exe with Base64-encoded or arithmetically-obfuscated arguments
- Restrict or disable .lnk execution from mail-delivered ZIP archives via mail-gateway policy / Group Policy
- Implement network detection content for blockchain-API-based C2 resolution patterns (EtherHiding-style TTPs)
- User awareness training for hospitality/travel staff on booking-themed spam and shortened-link lures (Google Share, etc.)
- Monitor WebSocket connections to newly-registered or algorithmically-suspicious domains on non-standard TLDs (.info, .cfd, .sbs, .bond, .pro, .shop)
Timeline of Malicious Windows Shortcuts (LNK) Deploy Node.js Backdoor
- TON smart contract transaction updates the resolved C2 domain to amanohuguta[.]cfd (blockchain-recorded timestamp).
- TON smart contract transaction updates the resolved C2 domain to hsaertyuoang34[.]sbs.
- TON smart contract transaction updates the resolved C2 domain to zloapobikahy23[.]bond.
- Earliest LNK samples sharing the MachineID win-5r0dsv23ed0 begin appearing (approximate month per LevelBlue clustering analysis).
- TON smart contract transaction updates the resolved C2 domain to tonajukbhuakpo2[.]shop.
- LevelBlue confirms new LNK samples matching the campaign's pattern are being observed daily as of publication, indicating the operation remains live and centrally operated rather than dormant.
- LevelBlue Managed Threat Research (SpiderLabs) publishes 'Hiding in the Chain', the primary technical analysis of the LNK-to-Node.js-to-TON-blockchain attack chain, after identifying the campaign while investigating a customer environment alert; more than 400 related LNK samples are clustered via the shared MachineID win-5r0dsv23ed0.
- Cyber Security News republishes and summarizes the LevelBlue SpiderLabs findings for a wider security-practitioner audience.
Sources cited for Malicious Windows Shortcuts (LNK) Deploy Node.js Backdoor
- Malicious Windows Shortcuts Use PowerShell and Node.js
- Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.js Backdoor
- DPRK Adopts EtherHiding: Nation-State Malware Hiding on Blockchains
- EtherHiding: How Web3 Infrastructure Enables Stealthy Malware Distribution
- Hackers Use EtherRAT and EtherHiding to Hide Malware Infrastructure on Ethereum
- The Unkillable C2: How Attackers Are Moving Command and Control to the Blockchain
- Potential Etherhiding C2 via Blockchain Connection
- Uncovering EtherHiding: Malware Hidden in Blockchain
Detection coverage for TL-2026-1178
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1178 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-1178
9 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.