Back Ground.News

Hackers Turn Trusted Node.js Runtime Into Malware Launcher in Ransomware

Ground.News • September 3, 2026

Threat actors are abusing the trusted, signed Node.js runtime to deploy malicious payloads, evading signature-based detection. Campaigns since February 2026 […]

Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks

Hackers Turn Trusted Node.js Runtime Into Malware Launcher in Ransomware-Linked Attacks

Cybercriminals are increasingly hijacking Node.js, the widely used JavaScript runtime, to slip malicious code past security defenses, according to new findings from the Symantec Threat Hunter Team. Since February 2026, multiple threat actors have abused the legitimate, digitally signed tool to execute malware while evading detection, with victims spanning government departments, technology firms, and hotels […]

There is no tracked Bias information for the sources covering this story.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Node.js Exploited in Ransomware Attacks Using EtherHiding Technique Since February 2026, threat actors have been exploiting the trusted Node.js runtime to deploy malicious payloads in targeted attacks against government departments, technology companies, and hotels. The technique leverages node.exe, a legitimate and signed developer tool, allowing attackers to run interpreted scripts that evade signature-based detection. Notable incidents include the use of EtherHiding, where attackers download Node.js to execute implants that communicate with Ethereum blockchain gateways for commands. The attacks have involved various tools, including ModeloRAT and C2Looper, and have been attributed to the initial access broker known as KongTuke. The campaign has reportedly compromised at least 31 organizations through social engineering tactics like fake CAPTCHA prompts. The ongoing threat landscape indicates a significant resurgence of Node.js abuse among cybercriminals, with multiple actors employing this method for persistence and execution. 8 sources 70

Extracted Entities

Hackers Turn Trusted Node.js Runtime Into Malware Launcher in Ransomware

The full story

Extracted Entities

Attack Types (2)

Industries (2)

MITRE ATT&CK (1)

Tools (1)