RoadK1ll Malware Turns Compromised Hosts into Network Relay Points

• •RoadK1ll malware enables attackers to pivot within networks undetected.
• •It uses a custom WebSocket protocol for covert communication.
• •The implant lacks traditional persistence, relying on active processes.

A new malware named RoadK1ll has been identified, allowing attackers to pivot within compromised networks. Discovered by Blackpoint during an incident response, RoadK1ll is a Node.js implant that communicates via a custom WebSocket protocol. Its primary function is to convert a single compromised machine into a relay point for attackers, enabling access to otherwise unreachable internal systems. The malware establishes an outbound WebSocket connection to attacker-controlled infrastructure, bypassing perimeter controls. It supports multiple concurrent connections and lacks traditional persistence mechanisms, operating only while its process is active. Blackpoint has shared indicators of compromise, including a hash for RoadK1ll and an IP address used for communication. The malware's stealthy operation makes it a significant concern for network security.