Node.js: Old Technique Makes a Comeback

MITRE Techniques

• [T1059.001] Command and Scripting Interpreter: PowerShell – Used to download scripts, launch payloads, and maintain beaconing; [‘a PowerShell script named earthquakeist.ps1 was then recorded’, ‘a persistent PowerShell downloaded another AdaptixC2 binary’]
• [T1059.007] Command and Scripting Interpreter: JavaScript – Node.exe was abused to execute malicious JavaScript payloads in an interpreted runtime; [‘use the trusted, signed runtime to execute a malicious implant’, ‘the malicious logic lives in interpreted scripts rather than in a binary’]
• [T1547.001] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Persistence was established by adding a Run key to relaunch node.exe at every login; [‘adding a randomly named value under the current user’s Run key’, ‘relaunch node.exe headlessly through conhost.exe at every login’]
• [T1105] Ingress Tool Transfer – Attackers downloaded official and malicious tooling, including Node.js and payloads; [‘download the official Node.js installer from nodejs.org’, ‘the persistent PowerShell downloaded another AdaptixC2 binary’]
• [T1068] Exploitation for Privilege Escalation – ClickFix-style lure was used for initial access via pasting and running attacker-supplied commands; [‘a command indicative of a ClickFix-style infection was executed’, ‘a victim pastes and runs an attacker-supplied string through the Windows Run dialog’]
• [T1071.001] Application Layer Protocol: Web Protocols – Beaconing and C2 activity used HTTP/HTTPS connections to attacker infrastructure; [‘repeated outbound HTTPS connections’, ‘generated by powershell.exe itself’]
• [T1071.004] Application Layer Protocol: DNS – Domain-based spoofing and use of lookalike domains supported command-and-control infrastructure; [‘domain spoofing of a company called Devmine’, ‘used the same C&C (datalayerservice)’]
• [T1562.001] Impair Defenses: Disable or Modify Tools – Payloads were repeatedly blocked, prompting attackers to change tactics and use Node.js to evade detection; [‘almost every payload they attempted to deploy … was blocked’, ‘use the trusted, signed runtime to execute a malicious implant’]
• [T1018] Remote System Discovery – Domain computer enumeration was performed to identify systems in Active Directory; [‘group “domain computers” /dom’, ‘giving the attackers a list of every machine joined to the Windows domain’]
• [T1135] Network Share Discovery – PowerShell/Windows tools were used in broader reconnaissance activity across the domain; [‘brief Active Directory reconnaissance command’, ‘giving the attackers a list of every machine joined to the Windows domain’]
• [T1041] Exfiltration Over C2 Channel – The implant likely retrieved commands or payloads from blockchain gateways over its C2 path; [‘most likely to retrieve commands or additional payloads hidden in a blockchain smart contract’, ‘made repeated connections to Ethereum blockchain gateways’]
• [T1566] Phishing – ClickFix-style lures were used to trick users into running attacker-supplied commands; [‘ClickFix-style lure was used for initial access’, ‘victim pastes and runs an attacker-supplied string’]