Yet Another NodeJS Backdoor (YaNB): A Modern Challenge
A resurgence in malicious campaigns exploiting deceptive CAPTCHA verifications has been observed, tricking users into executing NodeJS-based backdoors and deploying sophisticated Remote Access Trojans. The attack begins with a malicious NodeJS script connecting to attacker-controlled infrastructure, remaining passive until further commands are received. An advanced NodeJS RAT variant capable of tunneling malicious traffic through SOCKS5 proxies and using XOR-based encryption was uncovered. The campaign, known as KongTuke, uses compromised websites as initial access points. The malware employs anti-VM mechanisms, collects system information, and establishes persistence. It includes features for command execution, payload dropping, and covert communication. The RAT's functionality includes detailed system reconnaissance, remote command execution, and network traffic tunneling.
Pulse ID: 6826fc7e4da6d524398ef1ff
Pulse Link: https://otx.alienvault.com/pulse/6826fc7e4da6d524398ef1ff
Pulse Author: AlienVault
Created: 2025-05-16 08:51:10
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#BackDoor #CAPTCHA #CyberSecurity #Encryption #InfoSec #Malware #OTX #OpenThreatExchange #RAT #RemoteAccessTrojan #RemoteCommandExecution #SMS #Trojan #Troll #UK #bot #socks5 #AlienVault
