#ParsedReport #CompletenessHigh
03-09-2026

Node.js: Old Technique Makes a Comeback

https://www.security.com/threat-intelligence/node-js-returns-ransomware

Report completeness: High

Threats:
Etherhiding_technique
C2looper
Blackbasta
Modelorat
Kongtuke
Qilin_ransomware
Interlock
Rhysida
Akira_ransomware
8base
Embargo_ransomware
Cobalt_strike_tool
Adaptixc2_tool
Clickfix_technique
Looperc2
Asukastealer
Bitsadmin_tool
Etherrat
Mltbackdoor
Nltest_tool
Lolbin_technique

Victims:
Government departments, Technology companies, Hotels, Financial services, Insurance, Education, Information technology, Professional services

Industry:
Government, Education

Geo:
Asia, Asian

ChatGPT TTPs:
do not use without manual check
T1027, T1036.005, T1059.001, T1071.001, T1105, T1127, T1543.003, T1547.001, T1573

IOCs:
File: 19
IP: 7
Url: 13
Domain: 65
Command: 2
Path: 1
Hash: 43

Soft:
Node.js, Windows service, Active Directory, curl

Wallets:
mainnet

Crypto:
ethereum

Languages:
javascript, powershell

Platforms:
cross-platform