Node.js: Old Technique Makes a Comeback

    Tuesday, September 8, 2026 In: Threat Research Print

     

    Date: 09/08/2026

    Severity: High

    Summary

    The abuse of Node.js has resurfaced, with multiple threat actors targeting government departments, technology companies, and hotels since February 2026. Attackers use the legitimate, signed node.exe runtime to execute malicious scripts, evade signature-based detection, and maintain persistence through registry Run keys. In one Asian technology company intrusion, attackers used Node.js to run an implant that contacted Ethereum blockchain gateways, likely retrieving commands or payloads through EtherHiding. Other incidents involved the Rust-based C2Looper backdoor and ModeloRAT, linked to Woodgnat and ransomware operations involving Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo.

    Indicators of Compromise (IOC) List 

    Domains/URLs

    chat.doctecsolutions.com

    design.devminelimited.com 

    planner.devminelimited.com

    video.technodatabase.net

    api.technodatabase.net

    summonhood.com

    rebronzeal.com

    chat.devminelimited.com

    docs.datalayerservice.com

    api.datalayerservice.com

    resources.datalayerservice.com

    srv.doctecsolutions.com

    strapness.com

    microsoft.desereyunton.workers.dev

    authorized-logins.net

    b6w9m2z5x8q1v3k.top

    bestopebel.pl

    bookphotohot.pro

    bookphotoreserv.pro

    carrolc.com

    challenge-refernow.com

    cj06y9v4xab.com

    csa-humanchecknow.com

    cwrtwright.com

    defs.updater-worelos.com

    drivefeedback.com

    formulario.puentelargo.org

    ftps.upd-domain-goloro.com

    grande-luna.top

    helthfulcore.info

    http://178.16.54.253/~extranet/Tmsyz.exe

    http://178.16.54.253/~extranet/phot7482.exe

    http://193.58.122.42/files/hvnc2.exe

    http://193.58.122.42/files/rat.exe

    http://193.58.122.42/files/rat1.exe

    http://193.58.122.42/files/stil.exe

    http://193.58.122.42/files/stil1.exe

    http://94.156.114.250/files/lasttry.exe

    http://thomphon.com/update.msi

    https://toogwido.sa.com/Ca.ps1

    https://www.xt24.com/install/update.ps1

    human-check.top

    joincroud.info

    jokesprite.info

    justhandsoff.info

    kedvs4wiykc.com

    kiptownim.info

    klassniylink124.com

    legaar.com

    mail.authorized-logins.net

    mailes.upd-domain-goloro.com

    mails.updater-worelos.com

    ministrew.info

    mueleer.com

    nano.upscale-kolo.com

    ninetyorigins.com

    notstorageapis.com

    oeannon.com

    partner-conflrmpanel.com

    period-checkavaldx.com

    photbookguest.pro

    php.authorized-logins.net

    recepyman.info

    rotoa-upda-lo.com

    rs2y15sungu.com

    safedocphoto.info

    simsracing.net

    sql-updater-service.com

    sss.authorized-logins.net

    thomphon.com

    toogwido.sa.com

    upd-domain-goloro.com

    update.update-fall.com

    updater-worelos.com

    upscale-kolo.com

    visa-safedocs.info

    w3xasv14culvnqj.top

    IP Address 

    142.93.242.144

    144.31.53.78

    198.13.159.44

    199.91.221.42

    45.158.196.23

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    domainname like "oeannon.com" or url like "oeannon.com" or siteurl like "oeannon.com" or domainname like "kiptownim.info" or url like "kiptownim.info" or siteurl like "kiptownim.info" or domainname like "period-checkavaldx.com" or url like "period-checkavaldx.com" or siteurl like "period-checkavaldx.com" or domainname like "strapness.com" or url like "strapness.com" or siteurl like "strapness.com" or domainname like "nano.upscale-kolo.com" or url like "nano.upscale-kolo.com" or siteurl like "nano.upscale-kolo.com" or domainname like "legaar.com" or url like "legaar.com" or siteurl like "legaar.com" or domainname like "updater-worelos.com" or url like "updater-worelos.com" or siteurl like "updater-worelos.com" or domainname like "cj06y9v4xab.com" or url like "cj06y9v4xab.com" or siteurl like "cj06y9v4xab.com" or domainname like "sss.authorized-logins.net" or url like "sss.authorized-logins.net" or siteurl like "sss.authorized-logins.net" or domainname like "simsracing.net" or url like "simsracing.net" or siteurl like "simsracing.net" or domainname like "planner.devminelimited.com" or url like "planner.devminelimited.com" or siteurl like "planner.devminelimited.com" or domainname like "chat.devminelimited.com" or url like "chat.devminelimited.com" or siteurl like "chat.devminelimited.com" or domainname like "http://178.16.54.253/~extranet/Tmsyz.exe" or url like "http://178.16.54.253/~extranet/Tmsyz.exe" or siteurl like "http://178.16.54.253/~extranet/Tmsyz.exe" or domainname like "helthfulcore.info" or url like "helthfulcore.info" or siteurl like "helthfulcore.info" or domainname like "rebronzeal.com" or url like "rebronzeal.com" or siteurl like "rebronzeal.com" or domainname like "partner-conflrmpanel.com" or url like "partner-conflrmpanel.com" or siteurl like "partner-conflrmpanel.com" or domainname like "human-check.top" or url like "human-check.top" or siteurl like "human-check.top" or domainname like "drivefeedback.com" or url like "drivefeedback.com" or siteurl like "drivefeedback.com" or domainname like "formulario.puentelargo.org" or url like "formulario.puentelargo.org" or siteurl like "formulario.puentelargo.org" or domainname like "thomphon.com" or url like "thomphon.com" or siteurl like "thomphon.com" or domainname like "mails.updater-worelos.com" or url like "mails.updater-worelos.com" or siteurl like "mails.updater-worelos.com" or domainname like "defs.updater-worelos.com" or url like "defs.updater-worelos.com" or siteurl like "defs.updater-worelos.com" or domainname like "http://193.58.122.42/files/stil.exe" or url like "http://193.58.122.42/files/stil.exe" or siteurl like "http://193.58.122.42/files/stil.exe" or domainname like "http://thomphon.com/update.msi" or url like "http://thomphon.com/update.msi" or siteurl like "http://thomphon.com/update.msi" or domainname like "design.devminelimited.com" or url like "design.devminelimited.com" or siteurl like "design.devminelimited.com" or domainname like "update.update-fall.com" or url like "update.update-fall.com" or siteurl like "update.update-fall.com" or domainname like "microsoft.desereyunton.workers.dev" or url like "microsoft.desereyunton.workers.dev" or siteurl like "microsoft.desereyunton.workers.dev" or domainname like "mail.authorized-logins.net" or url like "mail.authorized-logins.net" or siteurl like "mail.authorized-logins.net" or domainname like "recepyman.info" or url like "recepyman.info" or siteurl like "recepyman.info" or domainname like "docs.datalayerservice.com" or url like "docs.datalayerservice.com" or siteurl like "docs.datalayerservice.com" or domainname like "w3xasv14culvnqj.top" or url like "w3xasv14culvnqj.top" or siteurl like "w3xasv14culvnqj.top" or domainname like "mueleer.com" or url like "mueleer.com" or siteurl like "mueleer.com" or domainname like "rs2y15sungu.com" or url like "rs2y15sungu.com" or siteurl like "rs2y15sungu.com" or domainname like "visa-safedocs.info" or url like "visa-safedocs.info" or siteurl like "visa-safedocs.info" or domainname like "upscale-kolo.com" or url like "upscale-kolo.com" or siteurl like "upscale-kolo.com" or domainname like "challenge-refernow.com" or url like "challenge-refernow.com" or siteurl like "challenge-refernow.com" or domainname like "toogwido.sa.com" or url like "toogwido.sa.com" or siteurl like "toogwido.sa.com" or domainname like "sql-updater-service.com" or url like "sql-updater-service.com" or siteurl like "sql-updater-service.com" or domainname like "notstorageapis.com" or url like "notstorageapis.com" or siteurl like "notstorageapis.com" or domainname like "rotoa-upda-lo.com" or url like "rotoa-upda-lo.com" or siteurl like "rotoa-upda-lo.com"

    Detection Query 2 :

    domainname like "b6w9m2z5x8q1v3k.top" or url like "b6w9m2z5x8q1v3k.top" or siteurl like "b6w9m2z5x8q1v3k.top" or domainname like "jokesprite.info" or url like "jokesprite.info" or siteurl like "jokesprite.info" or domainname like "php.authorized-logins.net" or url like "php.authorized-logins.net" or siteurl like "php.authorized-logins.net" or domainname like "ministrew.info" or url like "ministrew.info" or siteurl like "ministrew.info" or domainname like "api.datalayerservice.com" or url like "api.datalayerservice.com" or siteurl like "api.datalayerservice.com" or domainname like "ftps.upd-domain-goloro.com" or url like "ftps.upd-domain-goloro.com" or siteurl like "ftps.upd-domain-goloro.com" or domainname like "photbookguest.pro" or url like "photbookguest.pro" or siteurl like "photbookguest.pro" or domainname like "http://193.58.122.42/files/rat1.exe" or url like "http://193.58.122.42/files/rat1.exe" or siteurl like "http://193.58.122.42/files/rat1.exe" or domainname like "srv.doctecsolutions.com" or url like "srv.doctecsolutions.com" or siteurl like "srv.doctecsolutions.com" or domainname like "http://178.16.54.253/~extranet/phot7482.exe" or url like "http://178.16.54.253/~extranet/phot7482.exe" or siteurl like "http://178.16.54.253/~extranet/phot7482.exe" or domainname like "klassniylink124.com" or url like "klassniylink124.com" or siteurl like "klassniylink124.com" or domainname like "bookphotoreserv.pro" or url like "bookphotoreserv.pro" or siteurl like "bookphotoreserv.pro" or domainname like "grande-luna.top" or url like "grande-luna.top" or siteurl like "grande-luna.top" or domainname like "video.technodatabase.net" or url like "video.technodatabase.net" or siteurl like "video.technodatabase.net" or domainname like "ninetyorigins.com" or url like "ninetyorigins.com" or siteurl like "ninetyorigins.com" or domainname like "http://193.58.122.42/files/stil1.exe" or url like "http://193.58.122.42/files/stil1.exe" or siteurl like "http://193.58.122.42/files/stil1.exe" or domainname like "https://toogwido.sa.com/Ca.ps1" or url like "https://toogwido.sa.com/Ca.ps1" or siteurl like "https://toogwido.sa.com/Ca.ps1" or domainname like "summonhood.com" or url like "summonhood.com" or siteurl like "summonhood.com" or domainname like "kedvs4wiykc.com" or url like "kedvs4wiykc.com" or siteurl like "kedvs4wiykc.com" or domainname like "upd-domain-goloro.com" or url like "upd-domain-goloro.com" or siteurl like "upd-domain-goloro.com" or domainname like "http://193.58.122.42/files/hvnc2.exe" or url like "http://193.58.122.42/files/hvnc2.exe" or siteurl like "http://193.58.122.42/files/hvnc2.exe" or domainname like "mailes.upd-domain-goloro.com" or url like "mailes.upd-domain-goloro.com" or siteurl like "mailes.upd-domain-goloro.com" or domainname like "authorized-logins.net" or url like "authorized-logins.net" or siteurl like "authorized-logins.net" or domainname like "resources.datalayerservice.com" or url like "resources.datalayerservice.com" or siteurl like "resources.datalayerservice.com" or domainname like "bookphotohot.pro" or url like "bookphotohot.pro" or siteurl like "bookphotohot.pro" or domainname like "http://94.156.114.250/files/lasttry.exe" or url like "http://94.156.114.250/files/lasttry.exe" or siteurl like "http://94.156.114.250/files/lasttry.exe" or domainname like "justhandsoff.info" or url like "justhandsoff.info" or siteurl like "justhandsoff.info" or domainname like "chat.doctecsolutions.com" or url like "chat.doctecsolutions.com" or siteurl like "chat.doctecsolutions.com" or domainname like "https://www.xt24.com/install/update.ps1" or url like "https://www.xt24.com/install/update.ps1" or siteurl like "https://www.xt24.com/install/update.ps1" or domainname like "cwrtwright.com" or url like "cwrtwright.com" or siteurl like "cwrtwright.com" or domainname like "csa-humanchecknow.com" or url like "csa-humanchecknow.com" or siteurl like "csa-humanchecknow.com" or domainname like "joincroud.info" or url like "joincroud.info" or siteurl like "joincroud.info" or domainname like "safedocphoto.info" or url like "safedocphoto.info" or siteurl like "safedocphoto.info" or domainname like "http://193.58.122.42/files/rat.exe" or url like "http://193.58.122.42/files/rat.exe" or siteurl like "http://193.58.122.42/files/rat.exe" or domainname like "bestopebel.pl" or url like "bestopebel.pl" or siteurl like "bestopebel.pl" or domainname like "api.technodatabase.net" or url like "api.technodatabase.net" or siteurl like "api.technodatabase.net" or domainname like "carrolc.com" or url like "carrolc.com" or siteurl like "carrolc.com" or domainname like "design.devminelimited.com" or url like "design.devminelimited.com" or siteurl like "design.devminelimited.com" or domainname like "http://178.16.54.253/~extranet/Tmsyz.exe" or url like "http://178.16.54.253/~extranet/Tmsyz.exe" or siteurl like "http://178.16.54.253/~extranet/Tmsyz.exe" or domainname like "http://178.16.54.253/~extranet/phot7482.exe" or url like "http://178.16.54.253/~extranet/phot7482.exe" or siteurl like "http://178.16.54.253/~extranet/phot7482.exe"

    Detection Query 3 :

    dstipaddress IN ("199.91.221.42","144.31.53.78","198.13.159.44","45.158.196.23","142.93.242.144") or srcipaddress IN ("199.91.221.42","144.31.53.78","198.13.159.44","45.158.196.23","142.93.242.144")

    Reference:    

    https://www.security.com/threat-intelligence/node-js-returns-ransomware                                     


    Tags

    MalwareRansomwareCommercial FacilitiesGovernment Services and FacilitiesInformation TechnologyBlockchainRust MalwareBackdoorRATQilinInterlockAkiraBlack Basta

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.