Threat reportMalwareTL-2026-4453
Node.js Abuse Resurges: Woodgnat (KongTuke) ClickFix Campaigns Delivering ModeloRAT, AdaptixC2 and Ransomware-Linked Tooling
Node.js Abuse Resurges (TL-2026-4453), also tracked as Node.js abuse campaign, is a high-severity malware campaign, first published 2026-10-26. It is attributed to Woodgnat with medium confidence, affects Microsoft Windows (endpoints), maps to 14 MITRE ATT&CK techniques (T1018, T1049, T1056.002), and is covered by 9 detection rules and 31 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 14MITRE ATT&CK
- Actors
- 2Woodgnat
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 31Indicators of compromise
Key facts for TL-2026-4453
- Threat ID
- TL-2026-4453
- Also known as
- Node.js abuse campaign, CrashFix, ClickFix Node.js campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- Woodgnat, KongTuke
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Target sectors
- technology, finance, government administration, hospitality, insurance, education, professional services, ecommerce, logistics
- Target regions
- Asia, North America
- Detection rules
- 9
- Indicators of compromise
- 31
Malware and tooling in Node.js Abuse Resurges
Malware and tooling: 8base, AdaptixC2, AgendaCrypt, Black Basta - S1070, Cobalt Strike, EtherRAT, KongTuke, embargo, interlock, rhysida
How Node.js Abuse Resurges works
Symantec and Carbon Black Threat Hunter Team report renewed abuse of the Node.js runtime for execution and persistence by Woodgnat (aka KongTuke), an initial access broker linked to multiple ransomware families. Intrusions begin with ClickFix social engineering, use EtherHiding blockchain-based C&C lookups, and persist via Registry Run keys launching node.exe.
Since February 2026, Woodgnat (aka KongTuke), an initial access broker believed to develop ModeloRAT and Backdoor.Mistic (MLTBackdoor), has been observed abusing the legitimate Node.js runtime. After repeated attempts to deploy AdaptixC2 and Cobalt Strike beacons were blocked following ClickFix initial access, operators shifted to installing the official node.exe from nodejs.org and running malicious JavaScript, so that the malicious logic lives in interpreted scripts rather than in a binary.
Initial access uses ClickFix: victims are socially engineered into pasting an obfuscated PowerShell command into the Windows Run dialog. The command rebuilds the download cmdlet name and fetches a script from strapness[.]com with a per-victim token; in the Asian technology victim this wrote accumulatally.ps1 to the common application data directory as a persistent downloader. A related ClickFix variant, CrashFix, uses a malicious Chrome extension named NexShield that deliberately freezes the browser, plus a .NET payload named GateKeeper with layered encryption and fingerprinting. Node.js was deployed under a user WindowsApps cache path and persisted with a HKCU Run value launching conhost.exe --headless node.exe against a .dat file containing the JavaScript payload.
The Node.js implant used EtherHiding: from June 25, 2026 it roughly once a day queried Ethereum RPC gateway services (eth.llamarpc[.]com and mainnet.gateway.tenderly[.]co) to retrieve C&C configuration or payloads stored in a smart contract, with follow-up C2 on a Cloudflare Workers domain. Other reporting describes Polygon being used as the dynamically updatable address book. Post-compromise tooling includes AdaptixC2 agents, Cobalt Strike Beacons (thread.exe, thread_indirect.exe), C2Looper (Rust backdoor, C&C 45.158.196.23:8888) in a U.S. fintech intrusion from May 6, 2026, Backdoor.Mistic, EtherRAT, an AsukaStealer Node.js variant, a fake lock screen credential harvester, and a Node.js native addon evasion.node. Living-off-the-land activity includes net.exe, nltest, arp, netstat, netsh, reg, curl, bitsadmin, tar, Adsisearcher AD queries, Kerberos ticket scripts and PDQInventory for reconnaissance.
Woodgnat is linked to ransomware families Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta and Embargo. Victims include an Asian technology company (March 23 - July 25, 2026), a U.S. fintech (from May 6, 2026), government departments, and hotels in Asia; Backdoor.Mistic deployments span insurance, education, IT and professional services. Secondary reporting cites 31+ organizations compromised via ClickFix (GuidePoint Security). No CVE is involved; CVSS is not applicable and HIGH severity is an analyst judgement based on the ransomware linkage.
MITRE ATT&CK techniques used in TL-2026-4453
Discovery
T1018 Remote System Discovery; T1049 System Network Connections Discovery; T1087.002 Domain Account; T1482 Domain Trust Discovery
Credential Access
T1056.002 GUI Input Capture; T1558 Steal or Forge Kerberos Tickets
Execution
T1059.001 PowerShell; T1059.007 JavaScript; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1219 Remote Access Tools
Defense Evasion
Persistence
T1547.001 Registry Run Keys / Startup Folder
Collection
Affected products and versions in Node.js Abuse Resurges
Remediation for Node.js Abuse Resurges
Immediate actions
- Hunt for node.exe running from user-writable paths (e.g. AppData\Local\Microsoft\WindowsApps\Cache) or on hosts with no development role
- Hunt HKCU Run keys that launch conhost.exe --headless with node.exe and a .dat argument
- Block outbound access to the listed C2 domains and IPs
- Block or alert on Ethereum RPC gateways eth.llamarpc.com and mainnet.gateway.tenderly.co from non-blockchain hosts
- Alert on PowerShell launched from the Run dialog (explorer.exe parent) with obfuscated download cmdlets
Workarounds
- Disable or restrict the Windows Run dialog where operationally feasible
- Add detection for the evasion.node native addon hash
Longer-term hardening
- Restrict Node.js installation via application control on non-developer endpoints
- Train users on ClickFix/CrashFix prompts instructing them to paste commands into Run, PowerShell or Terminal
- Deploy EDR with behavioral detection of interpreter-based persistence
- Baseline network traffic to detect AdaptixC2 and Cobalt Strike beaconing
Timeline of Node.js Abuse Resurges
- Renewed Node.js abuse observed across multiple threat actors; Woodgnat attacks on government, technology and hotel targets begin (February 2026)
- Asian technology company compromised via ClickFix PowerShell command fetching a script from strapness[.]com
- Earliest observed activity at a U.S. fintech organization; C2Looper Rust backdoor deployed
- Node.js runtime deployed on the Asian tech victim and persisted via HKCU Run key launching conhost.exe --headless node.exe
- Node.js implant begins roughly daily queries to Ethereum RPC gateways for EtherHiding C&C configuration
- Final observed Node.js activity on the Asian technology victim after repeated blockchain gateway connections and failed C2 deployment attempts
- Symantec and Carbon Black Threat Hunter Team publish 'Node.js: Old Technique Makes a Comeback'
Sources cited for Node.js Abuse Resurges
Detection coverage for TL-2026-4453
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4453 across Splunk SPL, Microsoft KQL and Sigma, covering 31 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-4453
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.