NodeJS-based backdoor

The campaign begins with a spam email targeting the hospitality sector using booking themed lures.

When executed, the shortcut launches the PowerShell command... The downloaded PowerShell payload performs several post-execution steps to establish its runtime environment and prepare the next stage of the attack chain.

Finally, the malicious payload is executed via the installed or newly deployed Node.js runtime using the following command: Node.exe <JS payload> <decrypted c2>

The email contains a link hosted on Google Share... After redirection, the victim is prompted to retrieve a ZIP archive containing a malicious LNK file... The LNK file uses an icon from shell32.dll to make it look like an image file tricking the victim to run it.

The function D() is responsible for establishing persistence on the infected system. It executes a PowerShell command that creates a new Run Registry key.

The function D() is responsible for establishing persistence on the infected system. It executes a PowerShell command that creates a new Run Registry key.

The PowerShell command is obfuscated using two large integer (bigint) values... The resulting payload is a heavily obfuscated JavaScript code... the malware interprets encoded bytecode at runtime.

One of the malware's functions is to determine whether another instance of the dropped node.exe process is already running... Function X() is responsible for verifying internet connectivity before the malware proceeds with its execution.

powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"%AppData%\Nodejs\node-v24.13.0-win-x64\node.exe\" }).Count"

One of the malware's functions is to determine whether another instance of the dropped node.exe process is already running... Function X() is responsible for verifying internet connectivity before the malware proceeds with its execution.

After retrieving the C2 URL, the malware establishes a new WebSocket connection using the following format: wss://<C2>/w?user_id=<guid>

If Node.js is not installed, the script downloads a legitimate Node.js package from the official distribution site... The malware can download and execute additional payloads, supporting Windows executables as well as PowerShell and JavaScript execution.

DownloadAndRun and Remote Code Execution The malware can download and execute additional payloads, supporting Windows executables as well as PowerShell and JavaScript execution.

The malware also uses the EtherHiding technique, leveraging the TON blockchain to retrieve its command-and-control (C2) address... allowing threat actors to update the C2 address... without modifications to the malware itself.

Adds a Windows Defender exclusion for the file path using: Add-MpPreference -ExclusionProcess "{path}"