Threat reportMalwareTL-2026-2304
Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding Ransomware Access Brokers
Node.js Living-off-the-Land (TL-2026-2304), also tracked as Node.js LOTL Campaign, is a high-severity malware campaign, first published 2026-09-03. It is attributed to Woodgnat with medium confidence, affects Node.js Foundation / OpenJS Foundation Node.js runtime (node.exe, maps to 15 MITRE ATT&CK techniques (T1027, T1036, T1053), and is covered by 9 detection rules and 32 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 1Woodgnat
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 32Indicators of compromise
Key facts for TL-2026-2304
- Threat ID
- TL-2026-2304
- Also known as
- Node.js LOTL Campaign, ClickFix-to-Ransomware Access Chain
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Woodgnat
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- government administration, finance, hospitality, insurance, education, informationtechnology, professionalservices
- Target regions
- Asia, North America
- Detection rules
- 9
- Indicators of compromise
- 32
Malware and tooling in Node.js Living-off-the-Land
Malware and tooling: AdaptixC2, Cobalt Strike, EtherRAT, KongTuke
How Node.js Living-off-the-Land works
Since February 2026, threat actors of varying skill levels have revived abuse of the legitimate, signed Node.js interpreter (node.exe) to execute malicious JavaScript payloads and evade signature-based detection, deploying ModeloRAT, AdaptixC2, Cobalt Strike, C2Looper, Backdoor.Mistic, EtherRAT, and AsukaStealer via ClickFix-style social engineering. Several intrusions are attributed to the initial-access broker Woodgnat (aka KongTuke) and precede ransomware deployment by Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo affiliates.
Symantec/Broadcom's Threat Hunter Team documents a resurgence of the node.exe living-off-the-land (LOTL) technique: because node.exe is a legitimate, code-signed developer runtime, adversaries proxy execution of malicious JavaScript through it, bypassing binary-reputation and signature-based controls that would flag an unsigned or unfamiliar executable. Victims are typically lured via ClickFix-style fake-CAPTCHA or fake-error pages that trick them into pasting an attacker-supplied command into the Windows Run dialog, PowerShell, or Windows Terminal, which then downloads the legitimate Node.js installer from official sources before dropping and executing a malicious .js/.node payload. Persistence is established via HKCU Run-key registry entries executing conhost.exe with node.exe headlessly, and via services and scheduled tasks that re-launch PowerShell downloader stages at logon.
The campaign is not a single actor's work: Symantec observed the technique used opportunistically across intrusions of differing sophistication, from commodity infostealer deployment (AsukaStealer) to structured intrusions preceding ransomware. A notable thread ties several intrusions to Woodgnat (also tracked as KongTuke, 404 TDS, Chaya_002, LandUpdate808, TAG-124), a financially motivated initial-access broker active since May 2024 that sells durable enterprise footholds to ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Woodgnat is assessed to possibly be the developer of the Python-based ModeloRAT and is linked to the stealthy, memory-resident Backdoor.Mistic, which DLL-sideloads through the legitimate Microsoft endpoint-security binary MpExtMs.exe while masquerading as "EndpointDlp.dll."
A distinguishing C2 innovation observed in this campaign cluster is EtherHiding: malware (EtherRAT, and reportedly variants of AsukaStealer) retrieves C2 configuration -- URL, port, and encryption key -- from Ethereum smart contracts via public RPC gateways (eth.llamarpc.com, mainnet.gateway.tenderly.co), giving the operators censorship-resistant infrastructure with no attacker-controlled resolver to seize. Separately, the Rust-based C2Looper backdoor (documented by Zscaler ThreatLabz and observed being staged in one Node.js-LOTL fintech intrusion as the final payload) evolved from raw HTTP POST beaconing to a version that stores commands and exfiltrated data as JSON files inside per-victim GitHub repository paths, again abusing a trusted, allow-listed web service to blend C2 traffic into normal developer/CI network noise. The actors additionally abuse Cloudflare Workers (serverless subdomains such as microsoft.desereyunton.workers.dev) and domains spoofing legitimate companies (e.g., a fake Devmine and fake database-services brand) for staging and redirection.
Post-compromise activity documented across the linked intrusions includes native Windows network- and domain-reconnaissance utilities (Net, Netstat, Netsh, Nltest, Arp, Adsisearcher, and Kerberos-ticket-oriented scripts), credential theft via a fake lock-screen overlay, software/asset inventory via PDQInventory, and staged data exfiltration using Curl, Tar, and Bitsadmin. In the tracked fintech case, initial ClickFix-driven PowerShell activity and failed attempts to deploy AdaptixC2 and Cobalt Strike preceded a successful Node.js-based implant (using a native addon, evasion.node) that established registry persistence and ultimately staged the C2Looper Rust backdoor -- consistent with Woodgnat's pattern of selling access forward to ransomware operators.
MITRE ATT&CK techniques used in TL-2026-2304
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1055 Process Injection; T1127 Trusted Developer Utilities Proxy Execution; T1574 Hijack Execution Flow
Persistence
T1053 Scheduled Task/Job; T1547 Boot or Logon Autostart Execution
Credential Access
T1056 Input Capture; T1558 Steal or Forge Kerberos Tickets
Execution
T1059 Command and Scripting Interpreter
Command and Control
T1071 Application Layer Protocol
execution
Discovery
Resource Development
Affected products and versions in Node.js Living-off-the-Land
- Node.js Foundation / OpenJS Foundation — Node.js runtime (node.exe, Windows)
Vulnerable versions: any officially signed release when abused as a script-execution LOLBin
Fixed in: N/A - not a vulnerability; mitigated via application control, not patching - Microsoft — Windows (registry Run-key persistence, Windows Terminal ClickFix execution path)
Vulnerable versions: Windows 10; Windows 11; Windows Server
Fixed in: N/A - technique abuse, no vendor fix
Remediation for Node.js Living-off-the-Land
Patches
- N/A - this is a technique/tooling abuse campaign, not a software vulnerability; no vendor patch applies to node.exe itself
Immediate actions
- Block the documented C2 domains, Cloudflare Workers subdomain, and IP addresses at the network perimeter and web proxy
- Hunt for HKCU\Software\Microsoft\Windows\CurrentVersion\Run entries launching conhost.exe or node.exe with unusual or randomly-named values
- Hunt for node.exe or an unexpected .node/.js payload executing from user-writable paths (AppData, Temp, WindowsApps\cache) with no associated developer workflow
- Alert on outbound connections from non-developer endpoints to Ethereum RPC gateways (eth.llamarpc.com, mainnet.gateway.tenderly.co) or to raw.githubusercontent.com/GitHub API endpoints exchanging JSON beacon/command files
- Block or alert on execution of MpExtMs.exe loading a non-default/unsigned DLL (DLL side-loading), and on files named to mimic security-tooling components (e.g., EndpointDlp.dll)
Workarounds
- Restrict Node.js installer execution and node.exe presence to designated developer workstation groups via application control
- Disable or tightly scope clipboard-to-Run-dialog / clipboard-to-terminal execution patterns where feasible via GPO/endpoint policy
Longer-term hardening
- Deploy application allow-listing / WDAC so node.exe and other developer-utility binaries cannot execute arbitrary scripts outside approved developer host groups
- Deploy EDR behavioral detection for LOTL abuse of signed interpreters and for Trusted Developer Utilities Proxy Execution generally, not just classic LOLBins
- User awareness training targeting ClickFix / fake-CAPTCHA / 'paste this to fix the problem' lures across Run dialog, PowerShell, and Windows Terminal
- Monitor and restrict use of remote-access-tool scheduled tasks/services masquerading as AnyDesk, Splashtop, or similar legitimate remote-support software
- Treat any Node.js LOTL detection as a precursor to ransomware access-broker activity and escalate accordingly, including proactive threat hunting for Kerberos-ticket abuse and domain-trust reconnaissance
Timeline of Node.js Living-off-the-Land
- Woodgnat (KongTuke) initial-access-broker operation assessed as active since at least May 2024, selling durable enterprise footholds to ransomware affiliates
- Microsoft Defender Experts identify a widespread ClickFix campaign leveraging Windows Terminal (Win+X -> I) as the execution mechanism
- Node.js LOTL technique revival begins; wave of intrusions abusing signed node.exe to execute malicious JavaScript observed since February 2026
- An Asian technology company is compromised via the Node.js LOTL technique
- Attacker-directed download of the official Node.js installer observed as part of the intrusion chain
- Backdoor.Mistic first observed in cybercrime intrusions, deployed via DLL side-loading of MpExtMs.exe
- A Node.js-packaged variant of AsukaStealer first observed in the wild
- Initial ClickFix-driven activity begins against a U.S. fintech company, including failed attempts to deploy AdaptixC2 and Cobalt Strike
- Node.js JavaScript implant (using native addon evasion.node) executed and registry Run-key persistence established in the fintech intrusion
- Symantec/Broadcom Threat Hunter Team publishes Backdoor.Mistic / ModeloRAT report, first tying the activity to Woodgnat/KongTuke
- Multiple outlets (The Hacker News, BleepingComputer, The Register, HelpNetSecurity, SecurityAffairs) report on the Mistic-KongTuke link and its ransomware-broker implications
- C2Looper Rust backdoor staged as a final payload in the fintech intrusion following repeated failed deployment attempts and blockchain-based C2 communications
- Zscaler ThreatLabz publishes technical analysis of C2Looper, including its GitHub-based C2 evolution
- Symantec/Broadcom publishes 'Node.js: Old Technique Makes a Comeback,' consolidating the March-July 2026 campaign cluster across sectors
Sources cited for Node.js Living-off-the-Land
- Node.js: Old Technique Makes a Comeback
- Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker
- C2Looper Backdoor Uses GitHub for C2
- New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Attacks
- Stealthy Mistic backdoor linked to ransomware access broker KongTuke
- Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs
- Stealthy new backdoor surfaces in attacks on multiple sectors
- Inside Mistic, the New Stealth Backdoor in Ransomware Intrusions
- C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2
- AdaptixC2: Fingerprinting an Open-Source C2 Framework at Scale
- Unmasking AsukaStealer: The $80 Malware Threatening Your Digital Security
- EtherHiding: Blockchain Technology as a Cyber Weapon
- Caught in the CAPTCHA: How ClickFix is Weaponizing Verification Fatigue to Deliver RATs & Infostealers
- How ClickFix Uses Fake CAPTCHAs to Compromise Users
Detection coverage for TL-2026-2304
As of 2026-09-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2304 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-2304
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.