Attackers Abuse Legitimate Node.js Runtime to Deploy Persistent Malware in Targeted Operations
Cybercriminals are abusing the legitimate Node.js runtime to execute malicious JavaScript and establish persistent access on targeted networks. The technique has been observed since February 2026 against governments, technology companies, hotels, and financial organizations.
Attackers specifically target the signed node.exe binary rather than running custom malicious executables. By using the official runtime to interpret JavaScript payloads, they bypass many signature-based security controls.
In one documented incident against an Asian technology company, operators first attempted to deploy AdaptixC2 and Cobalt Strike. After these tools were blocked, the attackers downloaded the official Node.js installer and used it to run a persistent implant.
The malware creates a Windows registry entry to relaunch Node.js on every user login. It also establishes connections to Ethereum blockchain gateways, apparently to locate additional commands or payloads stored inside smart contracts.
The same Node.js-based approach has been linked to several implants, including ModeloRAT, Mistic, EtherRAT, and a variant of AsukaStealer. Some campaigns have been attributed to the initial-access broker Woodgnat, also known as KongTuke.
This activity has been connected to multiple ransomware operations, including those involving Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo, although Node.js abuse is not limited to a single threat actor.
Related articles
Drama RAT: Advanced Android Banking Trojan with RAT Capabilities Analyzed by Positive Technologies
Positive Technologies researchers have detailed Drama RAT, a sophisticated Android banking trojan distributed via phishing messages in messengers and disguised as VPN services or banking apps. The malware uses droppers that request installation of fake updates, then deliver a full-featured payload capable of stealing credentials, recording screens, and performing overlay attacks. Drama RAT automatically grants itself Accessibility permissions while hiding the process behind opaque overlays and employs multiple persistence mechanisms including AlarmManager alarms and Doze mode bypass. Communication occurs primarily over mTLS WebSocket with a fallback CDN channel, while anti-analysis features include over 1200 junk artifacts, broken AndroidManifest.xml, Frida hooking detection, and per-class string obfuscation. The trojan supports keylogging, SMS interception, VNC screen sharing, microphone and camera recording without indicators, and participation in DDoS attacks. Positive Technologies notes that removal is extremely difficult without ADB or safe mode because the malware redirects users away from settings screens.
Buhtrap RAT Resurfaces in New Campaign Targeting Russian Accountants via Search Ads
Specialists from F6 have identified a fresh distribution campaign for the Buhtrap RAT remote access trojan. Attackers continue to lure accountants and lawyers to counterfeit professional websites promoted through search engine advertisements. The latest lure mimics the legitimate resource Glavnaya Kniga Bukhgaltera, where visitors seeking documents instead receive a ZIP archive containing malicious payload delivered through JavaScript interception. The infection chain remains largely unchanged from prior operations, with the primary update being refreshed command-and-control infrastructure. Buhtrap has operated since 2014 as both malware and an associated criminal group; its source code leak in 2016 enabled wider adoption by financially motivated actors. Identified decoy domains include glavaudit.org, buhotchet.com, and audit24.org. Users are advised to verify site addresses carefully and avoid executing disguised EXE files.
Brazilian Malware BraZetsu Uses AI to Map and Sell Compromised Corporate Networks
Researchers have identified a new Windows malware called BraZetsu developed by the Brazilian actor Exilware. The tool maps compromised corporate networks, identifies high-value systems, and prepares access for sale to other criminals. The operation primarily targets Brazil and other countries in Latin America and the Iberian Peninsula. BraZetsu is written in Python with a modular architecture and maintains WebSocket communication with its command-and-control server. It searches for banking software, ERPs, e-commerce platforms, industrial environments, development tools, backup systems, and security solutions. The malware also looks for Brazilian CNAB financial files, digital certificates, and browser history. Evidence suggests heavy use of generative AI during development, with an AI component on the server that may classify stolen files and prioritize valuable machines.
Callfuscated: Reverse Engineering a Stack-Based VM Protected by MBA, Opaque Predicates and Call-Based Jumps
A detailed technical write-up examines the HackTheBox challenge Callfuscated, which combines virtualization, mixed Boolean-arithmetic expressions, opaque predicates and junk instructions. The author first converts call-pop sequences into direct jumps by proving that register r8 is never read, then removes the resulting NOPs to obtain clean code. The resulting binary reveals a classic stack-based virtual machine whose handlers invoke heavily obfuscated functions. Triton is used to lift these functions into AST form, after which the CoBRA solver simplifies the MBA expressions into the original operations: addition, subtraction, multiplication, XOR, OR and AND. With semantics recovered, the author captures the bytecode at runtime, writes a C translator that emits readable operations, compiles the output and obtains a clean decompiled routine that checks the flag.