Photo ZIP Phishing Campaign: Node.js Implant Targeting Hospitality Front-Desk Systems — Detection & Defense Guide

---
title: Suspicious Node.js Execution from User Profile Directory
id: 8a4f2c1e-9d7b-4e5a-8c3f-1a2b3c4d5e6f
status: experimental
description: Detects Node.js processes executing from user profile directories or temp folders, indicative of implant activity. Photo ZIP campaign drops Node.js binaries in non-standard paths.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/06/02
tags:
  - attack.execution
  - attack.t1059.007
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    Image|contains:
      - '\AppData\Local\Temp'
      - '\Downloads'
      - '\Desktop'
  condition: selection
falsepositives:
  - Legitimate developer activity
level: high
---
title: ZIP Archive Extraction with Photo-themed Filenames
id: 1b5g3d2f-0e8h-4f6i-9j1k-2l3m4n5o6p7q
status: experimental
description: Detects extraction of ZIP archives containing image file extensions, correlating with Photo ZIP social engineering campaign targeting hospitality.
references:
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/06/02
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: file_creation
  product: windows
detection:
  selection_zip:
    TargetFilename|contains: '.zip'
  selection_img:
    TargetFilename|endswith:
      - '.jpg'
      - '.jpeg'
      - '.png'
  selection_context:
    TargetFilename|contains:
      - '\AppData\Local\Temp'
      - '\Downloads'
  timeframe: 30s
  condition: all of selection_*
falsepositives:
  - Legitimate photo archive handling by staff
level: medium
---
title: Node.js Process with Network Connection to Non-Standard Port
id: 2c6h4e3g-1f9i-5g7j-0k2l-3m4n5o6p7q8r
status: experimental
description: Detects Node.js processes establishing network connections to non-standard ports, potentially indicating C2 communication from implant.
references:
  - https://attack.mitre.org/techniques/T1071/
author: Security Arsenal
date: 2026/06/02
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Image|endswith: '\node.exe'
    DestinationPort|not:
      - 80
      - 443
      - 8080
      - 3000
      - 8888
  condition: selection
falsepositives:
  - Local development servers
  - Internal Node.js applications
level: high

// Hunt for Node.js implant activity on front-desk systems
// Focus on hospitality environment patterns
let suspiciousProcesses = 
    DeviceProcessEvents
    | where Timestamp > ago(7d)
    | where FileName =~ "node.exe"
    | where FolderPath has_any ("\\AppData\\Local\\Temp", "\\Downloads", "\\Desktop")
    | extend ProcessPath =FolderPath, CommandLine =ProcessCommandLine;

let suspiciousConnections = 
    DeviceNetworkEvents
    | where Timestamp > ago(7d)
    | where InitiatingProcessFileName =~ "node.exe"
    | where RemotePort notin (80, 443, 8080, 3000, 8888)
    | where RemoteUrl !contains "." // Filter out FQDNs, focus on IPs
    | summarize ConnectionCount=count(), RemoteIPs=makeset(RemoteIP) by DeviceId, InitiatingProcessId;

suspiciousProcesses
| join kind=inner suspiciousConnections on DeviceId, $left.ProcessId == $right.InitiatingProcessId
| project Timestamp, DeviceName, ProcessPath, CommandLine, ConnectionCount, RemoteIPs, InitiatingProcessAccountName
| sort by Timestamp desc


// Correlate ZIP extraction with subsequent Node.js execution
let zipExtractionEvents = 
    DeviceFileEvents
    | where Timestamp > ago(14d)
    | where FileName endswith ".zip"
    | whereFolderPath contains_any ("\\Downloads", "\\Desktop")
    | project ExtractionTime=Timestamp, DeviceId, DeviceName, FolderPath, FileName, InitiatingProcessAccountName;

let nodeExecutionAfterZip = 
    DeviceProcessEvents
    | where Timestamp > ago(14d)
    | where FileName =~ "node.exe"
    | where FolderPath has_any ("\\AppData\\Local\\Temp", "\\Downloads")
    | project ExecutionTime=Timestamp, DeviceId, ProcessCommandLine;

zipExtractionEvents
| join kind=inner (nodeExecutionAfterZip) on DeviceId
| where ExecutionTime between (ExtractionTime .. (ExtractionTime + 5m))
| project ExtractionTime, DeviceName, FileName, ProcessCommandLine, TimeDelta=ExecutionTime-ExtractionTime, InitiatingProcessAccountName
| order by ExtractionTime desc

-- Hunt for Node.js implant indicators on endpoints
-- Focus on non-standard installation paths and recent activity

SELECT 
    Pid,
    Name,
    Exe,
    CommandLine,
    Username,
    CreateTime,
    hash(path=Exe) AS Hash
FROM pslist()
WHERE Name =~ "node"
  AND Exe =~ "(?i)(AppData\\Local\\Temp|Downloads|Desktop)"
  AND CreateTime > now() - 7d

-- supplementary hunt for recent ZIP file creation
SELECT 
    FullPath,
    Size,
    Mtime,
    Atime,
    Btime,
    hash(path=FullPath) AS Hash
FROM glob(globs="*/Downloads/*.zip", root=$HOME)
WHERE Mtime > now() - 14d

-- check for Node.js network connections
SELECT 
    Pid,
    Family,
    Type,
    Laddr,
    Raddr,
    State,
    Exe
FROM netstat()
WHERE Exe =~ "node"
  AND Raddr.Port NOT IN (80, 443, 8080, 3000, 8888)

# PowerShell script to detect and remediate Photo ZIP Node.js implant
# Run with elevated privileges on front-desk workstations

function Detect-NodeImplant {
    Write-Host "[+] Scanning for suspicious Node.js processes..." -ForegroundColor Cyan
    
    $suspiciousPaths = @(
        "$env:USERPROFILE\AppData\Local\Temp",
        "$env:USERPROFILE\Downloads",
        "$env:USERPROFILE\Desktop"
    )
    
    $suspiciousProcesses = Get-WmiObject Win32_Process | Where-Object {
        $_.Name -eq "node.exe" -and 
        ($suspiciousPaths | Where-Object { $_.ExecutablePath -like "$_*" })
    }
    
    if ($suspiciousProcesses) {
        Write-Host "[!] ALERT: Suspicious Node.js processes detected:" -ForegroundColor Red
        $suspiciousProcesses | Format-Table ProcessId, Name, CommandLine, ExecutablePath
        return $suspiciousProcesses
    } else {
        Write-Host "[-] No suspicious Node.js processes found." -ForegroundColor Green
        return $null
    }
}

function Remove-ImplantFiles {
    param(
        [string]$Path
    )
    
    Write-Host "[+] Checking for suspicious files in: $Path" -ForegroundColor Cyan
    
    $suspiciousFiles = @(
        "node.exe",
        "package.",
        "*.js"
    )
    
    foreach ($pattern in $suspiciousFiles) {
        $files = Get-ChildItem -Path $Path -Filter $pattern -Recurse -ErrorAction SilentlyContinue |
                 Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
        
        if ($files) {
            Write-Host "[!] Found suspicious files matching pattern '$pattern':" -ForegroundColor Yellow
            $files | ForEach-Object { 
                Write-Host "  - $($_.FullName) ($($_.LastWriteTime))"
                # Quarantine the file instead of deleting immediately
                $quarantinePath = "$env:TEMP\Quarantine\$(Get-Date -Format 'yyyyMMddHHmmss')\$($_.Name)"
                New-Item -ItemType Directory -Force -Path (Split-Path $quarantinePath) | Out-Null
                Move-Item -Path $_.FullName -Destination $quarantinePath -Force
                Write-Host "    Quarantined to: $quarantinePath" -ForegroundColor Green
            }
        }
    }
}

function Check-ZipActivity {
    Write-Host "[+] Checking for recent ZIP file activity..." -ForegroundColor Cyan
    
    $recentZips = Get-ChildItem -Path "$env:USERPROFILE\Downloads", "$env:USERPROFILE\Desktop" 
                          -Filter "*.zip" -ErrorAction SilentlyContinue |
                   Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) }
    
    if ($recentZips) {
        Write-Host "[!] Found recently modified ZIP files:" -ForegroundColor Yellow
        $recentZips | Format-Table FullName, LastWriteTime, Length
        return $true
    } else {
        Write-Host "[-] No recent ZIP activity found." -ForegroundColor Green
        return $false
    }
}

# Main execution block
Write-Host "[*] Starting Photo ZIP Node.js Implant Detection and Remediation" -ForegroundColor Cyan
Write-Host "[*] Timestamp: $(Get-Date)" -ForegroundColor Gray
Write-Host ""

$implantDetected = $false

# Check for suspicious processes
$suspiciousProcesses = Detect-NodeImplant
if ($suspiciousProcesses) { $implantDetected = $true }

# Check suspicious directories
foreach ($path in @("$env:USERPROFILE\AppData\Local\Temp", "$env:USERPROFILE\Downloads")) {
    if (Test-Path $path) {
        Remove-ImplantFiles -Path $path
    }
}

# Check for ZIP activity
$zipFound = Check-ZipActivity
if ($zipFound) { Write-Host "[!] Recommendation: Investigate recent ZIP files with security team." -ForegroundColor Yellow }

# Final summary
Write-Host ""
Write-Host "[*] Scan completed." -ForegroundColor Cyan
if ($implantDetected) {
    Write-Host "[!] ACTION REQUIRED: Potential implant detected. Isolate system and escalate to IR team." -ForegroundColor Red
    exit 1
} else {
    Write-Host "[-] No immediate threats detected. Continue monitoring." -ForegroundColor Green
    exit 0
}