# Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding Ransomware Access Brokers

> Since February 2026, threat actors of varying skill levels have revived abuse of the legitimate, signed Node.js interpreter (node.exe) to execute malicious JavaScript payloads and evade signature-based detection, deploying ModeloRAT, AdaptixC2, Cobalt Strike, C2Looper, Backdoor.Mistic, EtherRAT, and AsukaStealer via ClickFix-style social engineering. Several intrusions are attributed to the initial-access broker Woodgnat (aka KongTuke) and precede ransomware deployment by Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo affiliates.

- **Published:** 2026-09-03T00:00:00Z
- **Last reviewed:** 2026-09-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2304
- **ID:** TL-2026-2304
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Woodgnat
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Symantec/Broadcom's Threat Hunter Team documents a resurgence of the node.exe living-off-the-land (LOTL) technique: because node.exe is a legitimate, code-signed developer runtime, adversaries proxy execution of malicious JavaScript through it, bypassing binary-reputation and signature-based controls that would flag an unsigned or unfamiliar executable. Victims are typically lured via ClickFix-style fake-CAPTCHA or fake-error pages that trick them into pasting an attacker-supplied command into the Windows Run dialog, PowerShell, or Windows Terminal, which then downloads the legitimate Node.js installer from official sources before dropping and executing a malicious .js/.node payload. Persistence is established via HKCU Run-key registry entries executing conhost.exe with node.exe headlessly, and via services and scheduled tasks that re-launch PowerShell downloader stages at logon.

The campaign is not a single actor's work: Symantec observed the technique used opportunistically across intrusions of differing sophistication, from commodity infostealer deployment (AsukaStealer) to structured intrusions preceding ransomware. A notable thread ties several intrusions to Woodgnat (also tracked as KongTuke, 404 TDS, Chaya_002, LandUpdate808, TAG-124), a financially motivated initial-access broker active since May 2024 that sells durable enterprise footholds to ransomware affiliates including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta. Woodgnat is assessed to possibly be the developer of the Python-based ModeloRAT and is linked to the stealthy, memory-resident Backdoor.Mistic, which DLL-sideloads through the legitimate Microsoft endpoint-security binary MpExtMs.exe while masquerading as "EndpointDlp.dll."

A distinguishing C2 innovation observed in this campaign cluster is EtherHiding: malware (EtherRAT, and reportedly variants of AsukaStealer) retrieves C2 configuration -- URL, port, and encryption key -- from Ethereum smart contracts via public RPC gateways (eth.llamarpc.com, mainnet.gateway.tenderly.co), giving the operators censorship-resistant infrastructure with no attacker-controlled resolver to seize. Separately, the Rust-based C2Looper backdoor (documented by Zscaler ThreatLabz and observed being staged in one Node.js-LOTL fintech intrusion as the final payload) evolved from raw HTTP POST beaconing to a version that stores commands and exfiltrated data as JSON files inside per-victim GitHub repository paths, again abusing a trusted, allow-listed web service to blend C2 traffic into normal developer/CI network noise. The actors additionally abuse Cloudflare Workers (serverless subdomains such as microsoft.desereyunton.workers.dev) and domains spoofing legitimate companies (e.g., a fake Devmine and fake database-services brand) for staging and redirection.

Post-compromise activity documented across the linked intrusions includes native Windows network- and domain-reconnaissance utilities (Net, Netstat, Netsh, Nltest, Arp, Adsisearcher, and Kerberos-ticket-oriented scripts), credential theft via a fake lock-screen overlay, software/asset inventory via PDQInventory, and staged data exfiltration using Curl, Tar, and Bitsadmin. In the tracked fintech case, initial ClickFix-driven PowerShell activity and failed attempts to deploy AdaptixC2 and Cobalt Strike preceded a successful Node.js-based implant (using a native addon, evasion.node) that established registry persistence and ultimately staged the C2Looper Rust backdoor -- consistent with Woodgnat's pattern of selling access forward to ransomware operators.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1053 Scheduled Task/Job
- T1127 Trusted Developer Utilities Proxy Execution
- T1574 Hijack Execution Flow
- T1055 Process Injection
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1558 Steal or Forge Kerberos Tickets
- T1056 Input Capture
- T1482 Domain Trust Discovery
- T1071 Application Layer Protocol

## Sources

- [Node.js: Old Technique Makes a Comeback](https://www.security.com/threat-intelligence/node-js-returns-ransomware)
- [Backdoor.Mistic: New Backdoor May be Linked to Ransomware Access Broker](https://www.security.com/threat-intelligence/new-mistic-backdoor-modelorat)
- [C2Looper Backdoor Uses GitHub for C2](https://www.zscaler.com/blogs/security-research/c2looper-new-backdoor-likely-tied-ransomware-github-c2)
- [New Mistic Backdoor Linked to KongTuke in ClickFix and ModeloRAT Attacks](https://thehackernews.com/2026/06/new-mistic-backdoor-linked-to-kongtuke.html)
- [Stealthy Mistic backdoor linked to ransomware access broker KongTuke](https://www.bleepingcomputer.com/news/security/stealthy-mistic-backdoor-linked-to-ransomware-access-broker-kongtuke/)
- [Self-destructing Mistic backdoor linked to access broker selling corporate footholds to ransomware gangs](https://www.theregister.com/security/2026/06/25/self-destructing-mistic-backdoor-linked-to-access-broker-selling-corporate-footholds-to-ransomware-gangs/5262579)
- [Stealthy new backdoor surfaces in attacks on multiple sectors](https://www.helpnetsecurity.com/2026/06/25/mistic-backdoor-woodgnat-attacks/)
- [Inside Mistic, the New Stealth Backdoor in Ransomware Intrusions](https://securityaffairs.com/194207/cyber-crime/inside-mistic-the-new-stealth-backdoor-in-ransomware-intrusions.html)
- [C2Looper: A New Backdoor Likely Tied To Ransomware With GitHub C2](https://securityboulevard.com/2026/08/c2looper-a-new-backdoor-likely-tied-to-ransomware-with-github-c2/)
- [AdaptixC2: Fingerprinting an Open-Source C2 Framework at Scale](https://censys.com/blog/adaptixc2-open-source-c2-framework/)
- [Unmasking AsukaStealer: The $80 Malware Threatening Your Digital Security](https://www.seqrite.com/blog/unmasking-asukastealer-the-80-malware-threatening-your-digital-security/)
- [EtherHiding: Blockchain Technology as a Cyber Weapon](https://www.stormshield.com/news/cti-etherhiding-blockchain-technology/)
- [Caught in the CAPTCHA: How ClickFix is Weaponizing Verification Fatigue to Deliver RATs & Infostealers](https://www.sentinelone.com/blog/how-clickfix-is-weaponizing-verification-fatigue-to-deliver-rats-infostealers/)
- [How ClickFix Uses Fake CAPTCHAs to Compromise Users](https://cybelangel.com/blog/how-clickfix-uses-fake-captchas-to-compromise-users/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2304