#blackbasta — Public Fediverse posts on home.social

OTX Bot @[email protected] · 2026-09-03 · 17:32 UTC

Node.js: Old Technique Makes a Comeback

A resurgence in Node.js abuse has been observed since February 2026, targeting government departments, technology companies, and hotels. Attackers leverage the legitimate, signed node.exe binary to execute malicious JavaScript payloads, evading signature-based detection. In one intrusion at an Asian technology company, attackers downloaded the official Node.js installer after repeated payload blocks and used it to run an implant communicating with Ethereum blockchain gateways via EtherHiding techniques. The same threat actors compromised a U.S. fintech firm, deploying the Rust-based C2Looper backdoor linked to ransomware operations. Multiple attacks involved ModeloRAT, associated with initial access broker Woodgnat, connected to ransomware families including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo. Attackers employ ClickFix techniques for initial access and combine living-off-the-land tools with commodity malware.

Pulse ID: 6a996ed3562f794a642feaaf
Pulse Link: https://otx.alienvault.com/pulse/6a996ed3562f794a642feaaf
Pulse Author: AlienVault
Created: 2026-09-03 12:57:55

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#8Base #Akira #Asia #BackDoor #BlackBasta #BlockChain #CyberSecurity #EtherHiding #Government #InfoSec #Java #JavaScript #Malware #Nodejs #OTX #OpenThreatExchange #RAT #RansomWare #Rhysida #Rust #bot #AlienVault

#8base #akira #asia #backdoor #blackbasta #blockchain

OTX Bot @[email protected] · 2026-09-03 · 17:32 UTC

Node.js: Old Technique Makes a Comeback

A resurgence in Node.js abuse has been observed since February 2026, targeting government departments, technology companies, and hotels. Attackers leverage the legitimate, signed node.exe binary to execute malicious JavaScript payloads, evading signature-based detection. In one intrusion at an Asian technology company, attackers downloaded the official Node.js installer after repeated payload blocks and used it to run an implant communicating with Ethereum blockchain gateways via EtherHiding techniques. The same threat actors compromised a U.S. fintech firm, deploying the Rust-based C2Looper backdoor linked to ransomware operations. Multiple attacks involved ModeloRAT, associated with initial access broker Woodgnat, connected to ransomware families including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo. Attackers employ ClickFix techniques for initial access and combine living-off-the-land tools with commodity malware.

Pulse ID: 6a996ed3562f794a642feaaf
Pulse Link: https://otx.alienvault.com/pulse/6a996ed3562f794a642feaaf
Pulse Author: AlienVault
Created: 2026-09-03 12:57:55

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#8Base #Akira #Asia #BackDoor #BlackBasta #BlockChain #CyberSecurity #EtherHiding #Government #InfoSec #Java #JavaScript #Malware #Nodejs #OTX #OpenThreatExchange #RAT #RansomWare #Rhysida #Rust #bot #AlienVault

#8base #akira #asia #backdoor #blackbasta #blockchain

OTX Bot @[email protected] · 2026-09-03 · 17:32 UTC

Node.js: Old Technique Makes a Comeback

A resurgence in Node.js abuse has been observed since February 2026, targeting government departments, technology companies, and hotels. Attackers leverage the legitimate, signed node.exe binary to execute malicious JavaScript payloads, evading signature-based detection. In one intrusion at an Asian technology company, attackers downloaded the official Node.js installer after repeated payload blocks and used it to run an implant communicating with Ethereum blockchain gateways via EtherHiding techniques. The same threat actors compromised a U.S. fintech firm, deploying the Rust-based C2Looper backdoor linked to ransomware operations. Multiple attacks involved ModeloRAT, associated with initial access broker Woodgnat, connected to ransomware families including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo. Attackers employ ClickFix techniques for initial access and combine living-off-the-land tools with commodity malware.

Pulse ID: 6a996ed3562f794a642feaaf
Pulse Link: https://otx.alienvault.com/pulse/6a996ed3562f794a642feaaf
Pulse Author: AlienVault
Created: 2026-09-03 12:57:55

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#8Base #Akira #Asia #BackDoor #BlackBasta #BlockChain #CyberSecurity #EtherHiding #Government #InfoSec #Java #JavaScript #Malware #Nodejs #OTX #OpenThreatExchange #RAT #RansomWare #Rhysida #Rust #bot #AlienVault

#alienvault #bot #rust #rhysida #ransomware #rat

OTX Bot @[email protected] · 2026-09-03 · 17:32 UTC

Node.js: Old Technique Makes a Comeback

A resurgence in Node.js abuse has been observed since February 2026, targeting government departments, technology companies, and hotels. Attackers leverage the legitimate, signed node.exe binary to execute malicious JavaScript payloads, evading signature-based detection. In one intrusion at an Asian technology company, attackers downloaded the official Node.js installer after repeated payload blocks and used it to run an implant communicating with Ethereum blockchain gateways via EtherHiding techniques. The same threat actors compromised a U.S. fintech firm, deploying the Rust-based C2Looper backdoor linked to ransomware operations. Multiple attacks involved ModeloRAT, associated with initial access broker Woodgnat, connected to ransomware families including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo. Attackers employ ClickFix techniques for initial access and combine living-off-the-land tools with commodity malware.

Pulse ID: 6a996ed3562f794a642feaaf
Pulse Link: https://otx.alienvault.com/pulse/6a996ed3562f794a642feaaf
Pulse Author: AlienVault
Created: 2026-09-03 12:57:55

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#8Base #Akira #Asia #BackDoor #BlackBasta #BlockChain #CyberSecurity #EtherHiding #Government #InfoSec #Java #JavaScript #Malware #Nodejs #OTX #OpenThreatExchange #RAT #RansomWare #Rhysida #Rust #bot #AlienVault

#8base #akira #asia #backdoor #blackbasta #blockchain

OTX Bot @[email protected] · 2026-09-03 · 17:32 UTC

Node.js: Old Technique Makes a Comeback

A resurgence in Node.js abuse has been observed since February 2026, targeting government departments, technology companies, and hotels. Attackers leverage the legitimate, signed node.exe binary to execute malicious JavaScript payloads, evading signature-based detection. In one intrusion at an Asian technology company, attackers downloaded the official Node.js installer after repeated payload blocks and used it to run an implant communicating with Ethereum blockchain gateways via EtherHiding techniques. The same threat actors compromised a U.S. fintech firm, deploying the Rust-based C2Looper backdoor linked to ransomware operations. Multiple attacks involved ModeloRAT, associated with initial access broker Woodgnat, connected to ransomware families including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta, and Embargo. Attackers employ ClickFix techniques for initial access and combine living-off-the-land tools with commodity malware.

Pulse ID: 6a996ed3562f794a642feaaf
Pulse Link: https://otx.alienvault.com/pulse/6a996ed3562f794a642feaaf
Pulse Author: AlienVault
Created: 2026-09-03 12:57:55

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#8Base #Akira #Asia #BackDoor #BlackBasta #BlockChain #CyberSecurity #EtherHiding #Government #InfoSec #Java #JavaScript #Malware #Nodejs #OTX #OpenThreatExchange #RAT #RansomWare #Rhysida #Rust #bot #AlienVault