# Node.js Abuse Resurges: Woodgnat (KongTuke) ClickFix Campaigns Delivering ModeloRAT, AdaptixC2 and Ransomware-Linked Tooling

> Symantec and Carbon Black Threat Hunter Team report renewed abuse of the Node.js runtime for execution and persistence by Woodgnat (aka KongTuke), an initial access broker linked to multiple ransomware families. Intrusions begin with ClickFix social engineering, use EtherHiding blockchain-based C&C lookups, and persist via Registry Run keys launching node.exe.

- **Published:** 2026-10-26T13:43:55Z
- **Last reviewed:** 2026-10-26T13:43:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4453
- **ID:** TL-2026-4453
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Woodgnat
- **Detections:** 9 · **IOCs:** 31 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Since February 2026, Woodgnat (aka KongTuke), an initial access broker believed to develop ModeloRAT and Backdoor.Mistic (MLTBackdoor), has been observed abusing the legitimate Node.js runtime. After repeated attempts to deploy AdaptixC2 and Cobalt Strike beacons were blocked following ClickFix initial access, operators shifted to installing the official node.exe from nodejs.org and running malicious JavaScript, so that the malicious logic lives in interpreted scripts rather than in a binary.

Initial access uses ClickFix: victims are socially engineered into pasting an obfuscated PowerShell command into the Windows Run dialog. The command rebuilds the download cmdlet name and fetches a script from strapness[.]com with a per-victim token; in the Asian technology victim this wrote accumulatally.ps1 to the common application data directory as a persistent downloader. A related ClickFix variant, CrashFix, uses a malicious Chrome extension named NexShield that deliberately freezes the browser, plus a .NET payload named GateKeeper with layered encryption and fingerprinting. Node.js was deployed under a user WindowsApps cache path and persisted with a HKCU Run value launching conhost.exe --headless node.exe against a .dat file containing the JavaScript payload.

The Node.js implant used EtherHiding: from June 25, 2026 it roughly once a day queried Ethereum RPC gateway services (eth.llamarpc[.]com and mainnet.gateway.tenderly[.]co) to retrieve C&C configuration or payloads stored in a smart contract, with follow-up C2 on a Cloudflare Workers domain. Other reporting describes Polygon being used as the dynamically updatable address book. Post-compromise tooling includes AdaptixC2 agents, Cobalt Strike Beacons (thread.exe, thread_indirect.exe), C2Looper (Rust backdoor, C&C 45.158.196.23:8888) in a U.S. fintech intrusion from May 6, 2026, Backdoor.Mistic, EtherRAT, an AsukaStealer Node.js variant, a fake lock screen credential harvester, and a Node.js native addon evasion.node. Living-off-the-land activity includes net.exe, nltest, arp, netstat, netsh, reg, curl, bitsadmin, tar, Adsisearcher AD queries, Kerberos ticket scripts and PDQInventory for reconnaissance.

Woodgnat is linked to ransomware families Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta and Embargo. Victims include an Asian technology company (March 23 - July 25, 2026), a U.S. fintech (from May 6, 2026), government departments, and hotels in Asia; Backdoor.Mistic deployments span insurance, education, IT and professional services. Secondary reporting cites 31+ organizations compromised via ClickFix (GuidePoint Security). No CVE is involved; CVSS is not applicable and HIGH severity is an analyst judgement based on the ransomware linkage.

## MITRE ATT&CK

- T1204.004 Malicious Copy and Paste
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1547.001 Registry Run Keys / Startup Folder
- T1071.001 Web Protocols
- T1219 Remote Access Tools
- T1087.002 Domain Account
- T1482 Domain Trust Discovery
- T1018 Remote System Discovery
- T1049 System Network Connections Discovery
- T1056.002 GUI Input Capture
- T1558 Steal or Forge Kerberos Tickets
- T1197 BITS Jobs
- T1560 Archive Collected Data

## Sources

- [Node.js: Old Technique Makes a Comeback](https://www.security.com/threat-intelligence/node-js-returns-ransomware)
- [Attackers Turn Trusted Node.js Runtime (The Hacker News)](https://thehackernews.com/2026/09/attackers-turn-trusted-nodejs-runtime.html)
- [MITRE ATT&CK T1204.004 Malicious Copy and Paste](https://attack.mitre.org/techniques/T1204/004/)
- [MITRE ATT&CK T1102 Web Service](https://attack.mitre.org/techniques/T1102/)
- [MITRE ATT&CK T1547.001 Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001/)
- [Unit 42: Preventing the ClickFix Attack Vector](https://unit42.paloaltonetworks.com/preventing-clickfix-attack-vector/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4453