The detection problem is narrow and worth stating precisely. Symantec's own framing is that the malicious code lives in interpreted scripts rather than in a binary, so the file an endpoint agent hashes and signature-checks is node.exe, signed, and in at least one case downloaded from nodejs.org by the intruders themselves [3][4]. Persistence is a registry Run key that relaunches the script at every login [3].
What survives that is behaviour and lineage. Symantec's June 2026 write-up on Woodgnat describes node.exe executing attacker JavaScript and chaining PowerShell and Windows command-line tools [7]. In most estates, node.exe as the parent of powershell.exe is an alertable pair. The second cheap signal is inventory: the victim set includes government departments and hotels [1], environments where a JavaScript runtime has no business function, yet where a default allowlist for developer tooling still covers it.
The dwell numbers do not suggest smash-and-grab. The Asian technology company intrusion was observed from 23 March to 25 July 2026, which is 124 days [4][16]. At the U.S. fintech, the earliest activity was 6 May 2026 and C2Looper landed more than two months later, so no earlier than early July [8][9][17]. Symantec reports no evidence of credential theft, lateral movement, or destructive activity in that case, and says it is unclear whether the operators achieved anything beyond the foothold [9]. Read that as either patient access brokering or missing telemetry; the report supports both.
Attribution is doing more work than the runtime. The Node.js technique appears alongside ModeloRAT and Mistic, tied to the initial access broker KongTuke, also tracked as Woodgnat [6]. But at the fintech, Symantec says neither Node.js nor the Ethereum connection was observed, and links the intrusion to the same actors through shared domains and attack chain similarity, explaining the absence by noting the backdoor deployed successfully there [10]. That is infrastructure-based attribution with a plausible explanation attached, and it is worth logging as such.
Scale sits with GuidePoint Security, which counts at least 31 compromised organisations in a parallel ClickFix campaign using fake CAPTCHA prompts and a persistent backdoor that resolves its C2 through EtherHiding [13]. GuidePoint's point about the traditional fix, blocking the attacker's C2 server to cut off communication [15], is the part defenders should price: an on-chain lookup means the address arrives from a contract read, and blocklists trail it.
Symantec's closing assessment is that attackers of varying skill levels are picking up Node.js as it returns to popularity, mixing living-off-the-land tools with commodity malware and newer payloads including Mistic, C2Looper and a fresh AsukaStealer build [11][12]. That spread is the planning input. The control that scales is knowing which of your hosts have a reason to run node.exe.
