---
url: "https://xcademia.com/news/node-js-makes-a-comeback-as-attackers-abuse-trusted-runtime-in-2026"
title: Node.js Makes a Comeback as Attackers Abuse Trusted Runtime in 2026
description: "Attackers are reviving Node.js as a trusted execution technique, with campaigns linked to persistence, blockchain C2 and ransomware."
publishedAt: "2026-09-04T11:47:10.481+00:00"
updatedAt: "2026-09-04T12:17:05.160308+00:00"
type: news
category: cybersecurity
source_name: Symantec Threat Hunter Team
source_url: "https://www.security.com/threat-intelligence/node-js-returns-ransomware"
tags:
  - "#Cybersecurity"
  - "#NodeJS"
  - "#ThreatIntelligence"
  - "#Malware"
  - "#Ransomware"
  - "#EtherHiding"
  - "#CyberDefense"
  - "#EndpointSecurity"
---

# Node.js Makes a Comeback as Attackers Abuse Trusted Runtime in 2026

> Attackers are reviving Node.js as a stealthy execution and persistence technique, with recent campaigns targeting technology, finance, government and hospitality organizations, including activity linked to ransomware.

Source: **Symantec Threat Hunter Team** · 4 September 2026

Attackers are bringing an old technique back into active use: abusing the legitimate Node.js runtime to execute malicious JavaScript while attempting to avoid conventional malware detection.

The Symantec Threat Hunter Team has observed multiple actors using Node.js in attacks since February 2026. Victims have included government departments, technology companies and hotels, while some activity has been linked to ransomware-related operations.

The technique takes advantage of a simple characteristic of Node.js. The `node.exe` binary is a legitimate, digitally signed developer tool. Instead of deploying a conventional malicious executable, attackers can install the trusted runtime and use it to execute malicious scripts or other payloads.

Symantec's recent investigation highlights how this approach can also be combined with persistence mechanisms, PowerShell, command-and-control infrastructure and, in one intrusion, Ethereum blockchain services.

### 
Why attackers are turning to Node.js

Node.js is an open-source, cross-platform JavaScript runtime widely used for application development.

In an attack, however, the same runtime can become a tool for execution.

Rather than placing all malicious logic inside a traditional executable, attackers can rely on JavaScript or related components that are interpreted by `node.exe`. This can make the activity less dependent on a conventional malicious binary being detected.

Attackers can also establish persistence by registering a Node.js command in a Windows registry Run key, causing the runtime to launch again when a user logs in.

The technique itself is not new. What has changed is its renewed use across multiple campaigns and the range of malware and attack techniques being combined with it.

### 

![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1788522253258-info-1--125-.webp)

### 
A technology company attack shows the technique in action

One of the most detailed cases involved an Asian technology organization between March and July 2026.

The attackers initially gained access using a ClickFix-style technique and then launched an obfuscated PowerShell command. A PowerShell script was subsequently placed on the system and repeatedly executed through a service.

The attackers attempted several times to deploy AdaptixC2 agents and Cobalt Strike Beacon. Those attempts were blocked.

The defenders' ability to stop those conventional payloads appears to have influenced what happened next.

On March 29, the attackers downloaded the official Node.js installer directly from `nodejs.org`. Node.js had not apparently been used routinely on the host before that point.

The runtime later became part of the attackers' persistence and execution chain.

On May 21, `node.exe` and a native Node.js component called `evasion.node` were executed from the Windows Apps cache. The attackers then created a randomly named registry Run key that launched Node.js at every login.

The command passed another file to `node.exe`, although that file was not recovered for analysis.

The implant subsequently checked the host's public IP address and continued to run periodically. The `evasion.node` component was observed repeatedly between May 21 and July 25.

Meanwhile, the attackers continued trying to deploy other tools. An AdaptixC2 binary was blocked in June, followed by an attempted Cobalt Strike Beacon deployment that was also detected.

The sequence illustrates an important feature of the campaign: Node.js was not necessarily the attackers' first choice. It became particularly useful after other payloads repeatedly failed to execute.

### 
Node.js meets Ethereum blockchain infrastructure

The most unusual part of the Asian technology company intrusion came in late June.

Beginning June 25, the Node.js implant made repeated HTTPS connections to Ethereum blockchain RPC gateway services.

Symantec assessed that the implant was highly likely retrieving command-and-control configuration or additional payload information from a blockchain-based smart contract. This technique is known as **EtherHiding**.

EtherHiding allows attackers to conceal or update command-and-control information through blockchain infrastructure rather than relying entirely on conventional servers.

After communicating with Ethereum RPC services, the Node.js process was also observed communicating with a Cloudflare Workers domain that the attackers were likely abusing for command and control.

This combination shows how a legitimate runtime can be incorporated into a more complex attack chain involving multiple execution and communication techniques.

### 

A related U.S. fintech intrusion

The same actors also targeted a U.S. financial technology organization.

The attack began with activity consistent with a ClickFix-style infection, followed by PowerShell execution and attempts to deploy AdaptixC2 and Cobalt Strike Beacon.

Unlike the Asian technology organization, Node.js and Ethereum blockchain communications were not observed during this intrusion.

Instead, the attackers eventually deployed a Rust-based backdoor known as **C2Looper**.

Symantec linked one of the command-and-control indicators observed in the fintech intrusion to infrastructure previously documented by Zscaler in connection with C2Looper. The backdoor had been described as likely being used in ransomware-related attacks to establish a foothold for later movement.

The U.S. intrusion therefore provides another example of the same broader attack chain, but with a different final payload.

Symantec did not observe credential theft, lateral movement or a destructive payload during the intrusion described in the source, and it remains unclear whether the attackers achieved objectives beyond maintaining access.

![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1788522271499-info-2--106-.webp)

### 
Node.js activity extends beyond these two attacks

The recent investigations are part of a broader resurgence.

Symantec said Node.js has appeared in multiple attacks since at least February 2026. The activity does not appear to have been conducted by a single threat group.

Instead, different actors have used the technique for different purposes, ranging from ransomware-linked intrusions to credential and cryptocurrency theft.

Victims have included organizations across government, technology, hospitality and other sectors.

One notable example involved **AsukaStealer**, a Node.js version of the malware that Symantec had not previously observed in an attack. The malware-as-a-service tool can target credentials, session information, cookies and cryptocurrency wallet data, among other information.

It was observed targeting several hotels in Asia during May 2026.

Another example is **EtherRAT**, a Node.js-based remote access trojan associated with EtherHiding. The malware was observed in activity during May and June.

Node.js has also appeared alongside **Backdoor.Mistic** and **ModeloRAT** in other attacks.

Some ModeloRAT-related activity has been publicly associated with an initial access broker known as Woodgnat, also referred to as KongTuke. That activity has been linked publicly to several ransomware families, including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta and Embargo.

These associations do not mean that every Node.js attack described by Symantec was conducted by the same actor or had the same objective.

### 
Living-off-the-land techniques add another layer

The resurgence is also notable because attackers are not relying exclusively on newly developed malware.

The campaigns observed by Symantec combined Node.js with legitimate or dual-use tools such as PowerShell, Curl, Net, Netsh, Reg.exe and Bitsadmin.

These tools can have legitimate administrative purposes, which means their presence alone does not establish malicious activity.

The security challenge comes from the context in which they are used.

For example, an organization may legitimately use PowerShell and Node.js for development or administration. The risk becomes more significant when a previously unused Node.js runtime suddenly appears on a system, is launched from an unusual location, establishes persistence and begins communicating with unfamiliar infrastructure.

### 
What defenders should watch for

The renewed use of Node.js highlights why defenders should monitor execution behavior rather than relying exclusively on file-based signatures.

Potentially relevant signals include:

- `node.exe` appearing on systems where Node.js was not previously used
- Node.js executing scripts or files from unusual user or cache directories
- Registry Run keys launching `node.exe`
- Node.js processes making unexpected external network connections
- Node.js activity appearing alongside PowerShell or other scripting tools
- Repeated execution of Node.js components without an obvious development or administrative reason
- Node.js communicating with blockchain RPC services
- Unexpected combinations of Node.js, Cobalt Strike, AdaptixC2 or other post-compromise tooling
- New services launching PowerShell or Node.js repeatedly

None of these indicators should automatically be treated as malicious in isolation.

The announcement highlights a broader industry shift toward detecting **behavioral combinations** rather than focusing only on individual binaries.

For enterprises, this could mean establishing a baseline for legitimate Node.js usage and investigating deviations from that baseline.

The same principle can be applied to other legitimate runtimes and administrative tools. A trusted binary can require investigation when its execution context, persistence mechanism and network behavior do not fit the expected environment.

For the latest protection updates, the source directs readers to the Symantec Protection Bulletin.

### 
What this means for organizations

The resurgence of Node.js abuse does not mean organizations should remove Node.js or treat every installation as suspicious.

Instead, the activity reinforces the value of understanding where developer runtimes are installed, which systems legitimately require them and how they normally behave.

Organizations can consider monitoring:

1. **Unexpected installations**
Identify systems where Node.js appears without an established business or development requirement.
2. **Execution context**
Monitor unusual parent processes, locations and command-line arguments associated with `node.exe`.
3. **Persistence**
Look for registry Run keys, services and other mechanisms that repeatedly launch Node.js.
4. **Network behavior**
Investigate unexpected external connections from Node.js processes, particularly connections to unfamiliar infrastructure or blockchain RPC services.
5. **Tool combinations**
Correlate Node.js activity with PowerShell, Cobalt Strike, AdaptixC2 and other post-compromise activity.
6. **Behavior over time**
Periodic execution separated by hours or days can be more meaningful when combined with persistence and network activity than a single Node.js process would be.

The company did not provide specific information about this area beyond the protection guidance referenced in the source.

### 

![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1788522286803-info-3--99-.webp)

### 
An old technique with renewed relevance

The central finding from Symantec's investigation is straightforward: attackers are once again finding value in Node.js as an execution and persistence mechanism.

The technology itself remains legitimate. The security concern comes from its use as a trusted runtime inside malicious attack chains.

Recent activity shows the technique being combined with PowerShell, ClickFix-style access, dual-use tools, Cobalt Strike, AdaptixC2, malware families and blockchain-based command-and-control techniques.

The resurgence is a timely reminder that defensive strategies need to account for legitimate software being repurposed in unexpected ways.

As attackers continue combining older techniques with newer infrastructure, security teams may need to focus less on whether a tool is inherently malicious and more on whether its **execution, persistence and network behavior fit the organization's expected environment**.

## Original source

https://www.security.com/threat-intelligence/node-js-returns-ransomware

## Tags

`#Cybersecurity` · `#NodeJS` · `#ThreatIntelligence` · `#Malware` · `#Ransomware` · `#EtherHiding` · `#CyberDefense` · `#EndpointSecurity`

---

## About this content

This Markdown news article is the citation-grade twin of [Node.js Makes a Comeback as Attackers Abuse Trusted Runtime in 2026](https://xcademia.com/news/node-js-makes-a-comeback-as-attackers-abuse-trusted-runtime-in-2026). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite.

When citing or quoting, please attribute *Xcademia* and link back to the source URL above.

- Source: https://xcademia.com/news/node-js-makes-a-comeback-as-attackers-abuse-trusted-runtime-in-2026
- Publisher: Xcademia — https://xcademia.com
- Catalogue index: https://xcademia.com/llms-full.txt