Back Cybersecuritynews

Hackers Deploy RoadK1ll Pivoting Malware to Turn Compromised Hosts Into Network Relays

Cybersecuritynews •Tushar Subhra Dutta • March 31, 2026

A new piece of malware called RoadK1ll has been found silently converting compromised machines into controllable network relay points. Unlike most malware that arrives loaded with commands and attack tools, RoadK1ll is deliberately lean, built around one goal: giving attackers a reliable and silent path deeper into a network after initial compromise. That narrow focus […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

RoadK1ll Malware Turns Compromised Hosts into Network Relay Points A new malware named RoadK1ll has been identified, allowing attackers to pivot within compromised networks. Discovered by Blackpoint during an incident response, RoadK1ll is a Node.js implant that communicates via a custom WebSocket protocol. Its primary function is to convert a single compromised machine into a relay point for attackers, enabling access to otherwise unreachable internal systems. The malware establishes an outbound WebSocket connection to attacker-controlled infrastructure, bypassing perimeter controls. It supports multiple concurrent connections and lacks traditional persistence mechanisms, operating only while its process is active. Blackpoint has shared indicators of compromise, including a hash for RoadK1ll and an IP address used for communication. The malware's stealthy operation makes it a significant concern for network security. 3 sources 68

Hackers Deploy RoadK1ll Pivoting Malware to Turn Compromised Hosts Into Network Relays

The full story

Extracted Entities

Attack Types (1)

Malware (1)