When node.exe Turns Traitor: Inside KongTuke’s Living-off-the-Land Campaign

A signed, trusted developer tool is now doing the work of malware. Symantec’s Threat Hunter Team has documented a campaign in which attackers run the official Node.js runtime, node.exe, as a living-off-the-land binary (LOLBin). The malicious logic lives in interpreted JavaScript that the runtime loads and executes, not in a compiled binary that antivirus can fingerprint. As Symantec put it, the technique’s appeal is that node.exe “is a legitimate, signed developer tool.” That signature is exactly what lets it slip past controls built to trust it.

What happened

Between February and July 2026, an initial access broker tracked as KongTuke (also called Woodgnat) leaned on this approach across a string of intrusions. The entry point was ClickFix social engineering: fake CAPTCHA prompts that trick a user into pasting and running a command themselves. Once in, the actor established persistence through registry Run keys and reached for the trusted runtime instead of dropping a bespoke executable.

One intrusion running from March to July 2026 shows the full playbook. The attackers pulled the official installer straight from nodejs.org, ran JavaScript implants through the legitimate runtime, and chained PowerShell and built-in Windows utilities to move forward. They sat inside the network for more than two months before anyone noticed.

The payload list is long and varied. Researchers observed AdaptixC2, Cobalt Strike Beacon, a Rust backdoor called C2Looper, a Node.js build of AsukaStealer, and EtherRAT, alongside ModeloRAT, Mistic (also seen as MLTBackdoor), a malicious Chrome extension named NexShield, and a .NET tool called GateKeeper. GuidePoint’s Jean-Pierre Mouton also flagged EtherHiding, where command-and-control addresses are stashed on the Polygon blockchain and used as a “dynamically updatable address book.” Blocking one domain does nothing when the address list lives on a public chain the attacker can rewrite at will.

How the technique works

Signature-based detection asks a simple question: is this file known-bad? A JavaScript file interpreted by a signed runtime dodges that question entirely. There is no malicious binary to hash. The process tree shows node.exe, a program most developer laptops and plenty of servers run legitimately every day. The suspicious behaviour hides in the script it loads and in the utilities it spawns afterwards.

That is the point of a LOLBin. The attacker borrows a tool you already trust, so the noise they make looks like normal activity unless you are watching for the specific shape of it: node.exe reaching out to the internet, loading scripts from odd locations, or spawning PowerShell to do reconnaissance and lateral movement. The observed indicators are worth internalising:

Runtime abused:   node.exe (Node.js, downloaded from nodejs.org)
Access vector:    ClickFix fake-CAPTCHA prompts
Persistence:      registry Run keys
C2 addressing:    EtherHiding via Polygon blockchain
Dwell time:       2+ months (one Mar-Jul 2026 case)

Why it matters for Cyprus organisations

The victims were not niche. Government departments, technology companies (including an Asian tech firm), hotels, and a US fintech all turned up in the reporting. That spread maps neatly onto Cyprus: a public sector, a growing tech and fintech scene, and a hospitality industry that runs year-round. An initial access broker like KongTuke sells the foothold to whoever pays, so the follow-on damage, ransomware, data theft, or quiet espionage, is not fixed in advance.

The uncomfortable part is the two-month dwell time. If a signed runtime and a handful of built-in Windows tools can operate inside a network that long without tripping an alarm, the problem is not a missing product. It is that detection and network segmentation were never tested against an adversary who lives off the land.

What to do

Defence here is about behaviour, not signatures. Practical steps:

• Audit public-facing sites and pages for injected or malicious scripts, since ClickFix and drive-by delivery often start there.
• Restrict unapproved browser extensions through policy, given that NexShield rode in as one.
• Run ClickFix awareness training so staff recognise a fake CAPTCHA that asks them to paste a command.
• Monitor node.exe for anomalous script loading and unexpected child processes, and alert on it running where no developer workload exists.
• Segment the network so a single foothold cannot reach everything, and confirm those boundaries actually hold.

The only reliable way to know whether your EDR and segmentation catch this behaviour is to have someone try it against you under controlled conditions. That is the case for adversary-emulation red team operations: a team that deliberately lives off the land, abuses trusted binaries, and lingers to see whether your controls surface the activity or wave it through. A pass on paper means little if a signed runtime can run scripts for two months undetected.

The bottom line

KongTuke did not break Node.js. They borrowed its trust. Defenders who assume a signed process is a safe process are the ones who lose two months to an intruder. Watch behaviour, restrict what runs, train people against ClickFix, and test whether your defences catch a LOLBin before an access broker does it for you. Full technical detail is available via The Hacker News.