Loading malware…
NodeSnake is a custom remote-access trojan and persistent access backdoor associated with the Interlock ransomware operation, also tracked in some reporting as Hive0163 or GOLD EMBRACE. It has been used as an early-stage component in Interlock intrusions and commonly serves as the first-stage loader or persistent access layer within a broader malware framework that also includes InterlockRAT and related tooling. Reported campaigns have targeted organizations in North America and Europe, including education, healthcare, government, and other enterprise environments, and NodeSnake has been observed in attacks against U.K. universities.
The malware exists in multiple implementations, including a JavaScript variant for Node.js, Java JAR variants, and native C++ binaries. Across these variants, NodeSnake is described as a cross-platform backdoor that profiles infected hosts, establishes command-and-control communications, executes shell commands, maintains persistence, transfers files, and retrieves or launches additional payloads. Documented capabilities include interactive shell access, one-shot command execution, self-update, self-deletion, SOCKS5 proxying, and in some variants TCP tunneling, anti-debugging, and privilege-aware behavior. More recent reporting also notes the addition of screenshot collection functionality, indicating ongoing development.
NodeSnake has been repeatedly linked to ClickFix-style social engineering and fake-update style delivery chains in which victims are tricked into executing malicious commands, often through PowerShell, leading to installation of the RAT and follow-on deployment of additional malware. It has also been associated with trojanized software installer campaigns and broader traffic-distribution activity tied to Interlock operations. In observed intrusions, NodeSnake enabled long-dwell access, supported post-compromise operations, and preceded lateral movement, credential theft, data exfiltration, and eventual ransomware deployment.
Technical reporting indicates overlap between NodeSnake, InterlockRAT, JunkFiction, and other malware used by the same ecosystem, including shared code logic, infrastructure patterns, and crypter usage. These overlaps suggest NodeSnake is part of a private, actively maintained toolset used by a financially motivated extortion actor rather than a commodity malware family.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Noteworthy tactics, techniques, and procedures (TTPs) include the use of ClickFix-style social-engineering methods, a custom-built remote-access trojan (RAT) called "NodeSnake" or (alternately) "Interlock RAT," and a PHP-based backdoor for cross-platform persistence.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Interlock’s toolset includes NodeSnake, InterlockRAT, and other custom malware.
Noteworthy tactics, techniques, and procedures (TTPs) include the use of ClickFix-style social-engineering methods, a custom-built remote-access trojan (RAT) called "NodeSnake" or (alternately) "Interlock RAT," and a PHP-based backdoor for cross-platform persistence.
Beginning in early July 2026, the Blackpoint APG has identified the NodeSnake RAT being deployed again, with more than 5 incidents in the previous 14 days.
The attack in itself is said to have leveraged the ClickFix social engineering tactic to trick the victim into running a PowerShell command, which then downloads NodeSnake, a known malware attributed to Hive0163. A first-stage component, NodeSnake, is designed to run shell commands, establish persistence, and retrieve and launch a wider malware framework referred to as Interlock RAT.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The Interlock ransomware operation surfaced in September 2024 and has been linked to ClickFix and to malware attacks in which they deployed a remote access trojan called NodeSnake on the networks of multiple U.K. universities.
Initial Access | T1189 - Drive-by Compromise On Day 1 of the attack, an end-user device was linked by a ChatGPT search for Dynamics 365 to a reputable web property that is believed to have been compromised at the time with a ClickFix lure.
By day three, the attackers used a compromised domain administrator account to create a scheduled task on a print server. Scheduled task \Microsoft\Windows\Defrag\ScheduledDefrags Scheduled task created for persistence
Persistence | T1053.005 - Scheduled Task/Job:Scheduled Task On Day 3, the threat actor, using the compromised domain administrator account, executed the following command line instruction on a print server to create a scheduled task which executed persistence malware debug.log via node.exe
The attack in itself is said to have leveraged the ClickFix social engineering tactic to trick the victim into running a PowerShell command, which then downloads NodeSnake.
TERMINAL 0xa0 Interactive cmd.exe shell; TERMINAL_COMMAND 0xa1 One-shot cmd.exe /c... output to C:\Users\Public\<random>.txt
By day three, the attackers used a compromised domain administrator account to create a scheduled task on a print server. Scheduled task \Microsoft\Windows\Defrag\ScheduledDefrags Scheduled task created for persistence
Persistence | T1053.005 - Scheduled Task/Job:Scheduled Task On Day 3, the threat actor, using the compromised domain administrator account, executed the following command line instruction on a print server to create a scheduled task which executed persistence malware debug.log via node.exe
The Interlock ransomware operation surfaced in September 2024 and has been linked to ClickFix and to malware attacks in which they deployed a remote access trojan called NodeSnake on the networks of multiple U.K. universities.
Persistence | T1547.001 - Boot or Logon Autostart Execution:Registry Run Keys / Startup Folder At 00d 00:25:41, the threat actor installed a malicious command into the Auto-Start Extensibility Points (ASEP) registry to run at startup, in order to maintain persistence on the device.
By day three, the attackers used a compromised domain administrator account to create a scheduled task on a print server. Scheduled task \Microsoft\Windows\Defrag\ScheduledDefrags Scheduled task created for persistence
Persistence | T1053.005 - Scheduled Task/Job:Scheduled Task On Day 3, the threat actor, using the compromised domain administrator account, executed the following command line instruction on a print server to create a scheduled task which executed persistence malware debug.log via node.exe
Thread execution hijacking : uses SetThreadContext / GetThreadContext to inject into running threads.
Persistence | T1547.001 - Boot or Logon Autostart Execution:Registry Run Keys / Startup Folder At 00d 00:25:41, the threat actor installed a malicious command into the Auto-Start Extensibility Points (ASEP) registry to run at startup, in order to maintain persistence on the device.
Thread execution hijacking : uses SetThreadContext / GetThreadContext to inject into running threads.
DELETE 0x0c fs.rmSync(__filename)... If the counter passes 40, the implant deletes itself... self-deleting scheduled task... --delete (self-delete after encryption)
The PowerShell script functions as a full-fledged backdoor that can beacon a heartbeat message containing system information to a C2 server every 30 seconds, poll for a new command every 50 seconds, execute it via "cmd.exe," and relay the results back to the server.
The implant connects over ws:// and rotates across nine Cloudflare Tunnel domains plus three fallback IP addresses... All three tiers use the same transport protocol... RC4-encrypted WebSocket framing.
Operator commands. The implant supports 12 message types: SOCKS5 0x05 SOCKS5 proxy... The native implant runs a multi-threaded design: SocksThread SOCKS4 proxy handler Socks5Thread SOCKS5 proxy handler
The C2 infrastructure runs through free Cloudflare Tunnel endpoints as disposable WebSocket relays, falling back to hardcoded IPs on hosting providers.
The native variant adds several features not present in the scripted tiers: TCP tunnel relay (TcpTunnel): forwards arbitrary TCP connections through the implant, allowing the operator to reach internal hosts.
Once inside, attackers use traffic distribution systems to redirect victims and deliver payloads through ClickFix-style attacks or fake browser updates. | NodeSnake, which acts as the first stage loader in most Interlock infections, shares code logic and server addresses with both JunkFiction downloader and InterlockRAT.
27 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Named as part of Interlock's toolset in the campaign.
A custom-built remote access trojan used by the Interlock ransomware group for persistence and remote access during intrusions.
A remote access trojan tied in the content to the Interlock Ransomware operation, delivered via ClickFix-style attacks and described as evolving with a new screenshot collection module.
A first-stage loader used in most Interlock infections. It shares code logic and infrastructure with JunkFiction and InterlockRAT, and its code structure was later extended by ModeloRAT.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.