Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

www.itsecuritynews.info • September 3, 2026

According to a new report published by the Symantec Threat Hunter Team today, the attack method has been put to use in attacks targeting government departments, technology companies, and hotels since February 2026.

"The technique's appeal is that node.exe (the

Read the original article:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Node.js Exploited in Ransomware Attacks Using EtherHiding Technique Since February 2026, threat actors have been exploiting the trusted Node.js runtime to deploy malicious payloads in targeted attacks against government departments, technology companies, and hotels. The technique leverages node.exe, a legitimate and signed developer tool, allowing attackers to run interpreted scripts that evade signature-based detection. Notable incidents include the use of EtherHiding, where attackers download Node.js to execute implants that communicate with Ethereum blockchain gateways for commands. The attacks have involved various tools, including ModeloRAT and C2Looper, and have been attributed to the initial access broker known as KongTuke. The campaign has reportedly compromised at least 31 organizations through social engineering tactics like fake CAPTCHA prompts. The ongoing threat landscape indicates a significant resurgence of Node.js abuse among cybercriminals, with multiple actors employing this method for persistence and execution. 8 sources 70

Extracted Entities

Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

The full story

Extracted Entities

Attack Types (1)

Industries (2)

MITRE ATT&CK (1)

Tools (1)