Hackers Turn Trusted Node.js Runtime Into Malware Launcher in Ransomware-Linked Attacks

Cybercriminals are increasingly hijacking Node.js, the widely used JavaScript runtime, to slip malicious code past security defenses, according to new findings from the Symantec Threat Hunter Team.

Since February 2026, multiple threat actors have abused the legitimate, digitally signed tool to execute malware while evading detection, with victims spanning government departments, technology firms, and hotels across Asia and the United States.

Node.js’s appeal to attackers lies in its legitimacy. Because node.exe is a signed, trusted developer tool, security software rarely flags it as suspicious.

Node.js Runtime Into Malware Launcher

Instead of dropping a conventional malicious executable, attackers stage the genuine runtime and use it to run malicious JavaScript, keeping the harmful logic hidden inside interpreted scripts rather than a binary. Persistence is achieved by quietly registering the tool in a Windows registry Run key, ensuring it relaunches automatically every time a victim logs in.

One of the most striking cases involved an Asian technology company where attackers, repeatedly blocked while trying to deploy AdaptixC2 agents and Cobalt Strike Beacon, resorted to downloading the official Node.js installer directly from nodejs.org.

They then used the runtime to run an implant that reached out to Ethereum blockchain gateways, a technique known as EtherHiding, in which commands or payloads are concealed inside smart contracts.

The same group also breached a U.S. fintech firm, this time deploying a Rust-based backdoor called C2Looper, previously documented by Zscaler as malware likely used to establish footholds for ransomware operators ahead of lateral movement. Shared command-and-control infrastructure, including the domain datalayerservice, links the two intrusions to a single actor.

Other attacks combined Node.js abuse with ModeloRAT, a tool believed to be built by an initial access broker known as Woodgnat or KongTuke. That broker has been tied to multiple ransomware families, including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo.

Symantec notes the technique isn’t confined to one group. Since February, various actors with differing skill levels and goals, ranging from ransomware precursors to credential and cryptocurrency theft, have adopted Node.js abuse.

Notable tools observed alongside it include a new Node.js version of AsukaStealer, used against Asian hotels, and EtherRAT, another blockchain-reliant remote access trojan.

Because the malicious activity hides inside a trusted runtime, security teams should monitor for unexpected Node.js installations, unusual Run-key registry entries, and outbound traffic to blockchain RPC endpoints like Ethereum gateways, all unusual signs on machines that shouldn’t normally run developer tools. As Symantec’s researchers put it, the resurgence of this old technique is a reminder that attackers rarely abandon methods that still work.

Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.