Woodgnat Node.js Abuse Campaign: ModeloRAT, AsukaStealer & AdaptixC2 via ClickFix — OTX Detection Pack

Threat Summary

A single high-density OTX pulse (TLP:WHITE, modified 2026-09-03) documents a coordinated campaign attributed to the adversary cluster tracked as Woodgnat, active since at least February 2026. The campaign represents a resurgence of an old but effective technique: abusing the legitimate, digitally signed node.exe binary to execute malicious JavaScript payloads directly in memory, bypassing signature-based antivirus and application whitelisting controls that trust the Node.js runtime.

The intrusion set spans Technology, Finance, Government, Hospitality, and Education sectors, with confirmed targeting of U.S. organizations and at least one documented intrusion at an Asian technology company — where attackers, after repeated payload blocks, simply downloaded the official Node.js installer from the vendor site and used it as their execution vehicle. This is the core lesson: when your controls block the malware but not the interpreter, the adversary installs the interpreter.

The campaign's tooling stack is unusually broad, indicating a mature access operation feeding downstream monetization:

• Initial access: ClickFix-style social engineering (fake browser updates, CAPTCHA verification lures) tricking users into pasting malicious commands
• Execution: Living-off-the-land abuse of node.exe to run obfuscated JavaScript payloads
• Payloads: ModeloRAT, Backdoor.Mistic, AsukaStealer, EtherRAT
• Post-exploitation: AdaptixC2 and Cobalt Strike Beacon for hands-on-keyboard operations
• C2 innovation: EtherHiding — C2 configuration and payload staging hidden in blockchain smart contracts, using infrastructure like mainnet.gateway.tenderly.co (a legitimate Ethereum RPC gateway) as an unwitting dead-drop resolver

Tags on the pulse explicitly reference a ransomware access broker function — meaning Woodgnat intrusions are likely initial access operations sold or handed off to ransomware affiliates. The presence of AsukaStealer confirms credential theft is a primary objective: harvested browser credentials, session cookies, and authentication tokens are both monetized directly on dark web markets and used to deepen access before the handoff.

Threat Actor / Malware Profile

Woodgnat (Adversary Cluster)

Woodgnat operates as an access broker with a multi-family malware arsenal. The diversity of tooling — commodity stealers alongside custom RATs and two separate C2 frameworks — suggests either a well-resourced group or a collaborative cluster sharing infrastructure.

Attack Chain Breakdown

1. Distribution — ClickFix Social Engineering Victims encounter compromised or malicious sites presenting fake CAPTCHA or "browser update required" prompts. The page instructs the user to press Win+R and paste a clipboard-injected command. That command typically invokes mshta, powershell, or curl to retrieve a JavaScript payload and execute it via Node.js.

2. Execution — Signed Binary Proxy (T1218 / T1059.007) node.exe is a legitimate, signed binary. Payloads are executed as:

node.exe C:\Users\Public\update.js
node.exe -e "<inline eval payload>"

Because Node.js can make raw HTTP/HTTPS requests, spawn child processes, and access the file system via its standard library, a single .js file is a fully capable loader.

3. Payload Behavior

• AsukaStealer: Harvests browser credential stores (Chrome/Edge/Firefox), cookies, autofill data, cryptocurrency wallets, and Discord/Telegram tokens. Stages stolen data in archives for exfiltration.
• ModeloRAT / Backdoor.Mistic / EtherRAT: Provide remote command execution, file transfer, and secondary payload delivery. EtherRAT is notable for blockchain-assisted C2 resolution.
• AdaptixC2 / Cobalt Strike Beacon: Deployed post-compromise for lateral movement and persistence — the signature of an access broker preparing the environment for sale.

4. C2 Communication — EtherHiding (T1071.001 / T1102) Rather than relying solely on hardcoded C2 domains, the campaign uses EtherHiding: C2 addresses and payload fragments are stored in BNB Smart Chain / Ethereum smart contract data, retrieved via public RPC gateways such as mainnet.gateway.tenderly.co. This makes C2 takedown nearly impossible — blockchain data is immutable and the RPC gateway is legitimate infrastructure. Traditional C2 (mueleer.com, grande-luna.top, oeannon.com, mail.authorized-logins.net, www.xt24.com) is used in parallel for direct beaconing.

5. Persistence & Anti-Analysis

• Scheduled tasks and Run keys masquerading as legitimate updater entries ("NodeUpdater", "OneDriveSync"-style names)
• Payloads staged in %APPDATA%, %LOCALAPPDATA%\Temp, and C:\Users\Public
• Repeated-block evasion: on detection, operators pivot delivery method (as documented — switching to the official installer download)
• Obfuscated/minified JavaScript with string concatenation and base64 layers to defeat static inspection

IOC Analysis

The pulse contains 180 indicators. Representative samples:

Operationalization Guidance for SOC Teams

1. IPs and malicious domains → push to egress firewall, DNS sinkhole (RPZ), and web proxy block lists immediately. Low false-positive risk.
2. mainnet.gateway.tenderly.co → treat as contextual detection, not a block. This is legitimate blockchain RPC infrastructure. Alert only when the connecting process is anomalous: node.exe outside development contexts, powershell.exe, rundll32.exe, or Office processes making Web3 RPC calls (look for eth_call, eth_getStorageAt, JSON-RPC POST bodies).
3. Retro-hunt 90 days of DNS/proxy/NetFlow logs for all indicators — the campaign dates to February 2026.
4. Pivot tooling: Validate and enrich indicators with VirusTotal, urlscan.io, and GreyNoise; detonate .js payloads in ANY.RUN or Joe Sandbox to extract second-stage C2 and smart contract addresses. Decode obfuscated JavaScript with de4js, js-beautify, or by instrumenting Node in a sandbox with node --inspect.
5. Dark web monitoring: Given the access-broker function and AsukaStealer's role, monitor stealer-log marketplaces and Telegram channels for corporate credentials and session cookies tied to your domains.

Detection Engineering

---
title: Node.js Execution of Suspicious JavaScript Payload
description: Detects node.exe executing JavaScript files from user-writable or temp locations, consistent with Woodgnat campaign abuse of the signed Node.js binary for ModeloRAT/AsukaStealer delivery
id: 7a3c1f2e-9b4d-4e8a-b1c5-2d6f8a0e9c3b
status: experimental
author: Security Arsenal Threat Intelligence
references:
  - https://www.security.com/threat-intelligence/node-js-returns-ransomware
logsource:
  category: process_creation
  product: windows
detection:
  selection_image:
    Image|endswith: '\node.exe'
  selection_paths:
    CommandLine|contains:
      - '\Users\Public\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\ProgramData\'
      - '\Downloads\'
  selection_eval:
    CommandLine|contains: ' -e '
  condition: selection_image and (selection_paths or selection_eval)
falsepositives:
  - Legitimate development activity on developer workstations
  - Node.js-based enterprise applications (apply allowlist by install path, e.g. Program Files)
level: high
tags:
  - attack.execution
  - attack.t1059.007
  - attack.t1218
---
title: EtherHiding - Non-Browser Process Contacting Blockchain RPC Gateway
description: Detects suspicious processes connecting to public blockchain RPC endpoints (EtherHiding C2 technique) as observed in Woodgnat EtherRAT/ModeloRAT operations
date: 2026/09/03
id: 8b4d2e3f-0c5e-5f9b-c2d6-3e7a9b1f0d4c
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: network_connection
  product: windows
detection:
  selection_domain:
    DestinationHostname|contains:
      - 'mainnet.gateway.tenderly.co'
      - 'bsc-dataseed'
      - 'rpc.ankr.com'
      - 'mainnet.infura.io'
      - 'eth.llamarpc.com'
  selection_process:
    Image|endswith:
      - '\node.exe'
      - '\powershell.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\wscript.exe'
      - '\cscript.exe'
  condition: selection_domain and selection_process
falsepositives:
  - Legitimate Web3 development activity (restrict to non-developer assets)
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1102
---
title: ClickFix Pattern - Run Dialog Spawning Script Interpreter Chain
description: Detects explorer-spawned script interpreters with download cradles, matching ClickFix social engineering lure execution used by Woodgnat for initial access
id: 9c5e3f4a-1d6f-6a0c-d3e7-4f8b0c2a1e5d
status: experimental
author: Security Arsenal Threat Intelligence
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\msedge.exe'
      - '\chrome.exe'
      - '\firefox.exe'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\mshta.exe'
      - '\wscript.exe'
  selection_cmd:
    CommandLine|contains:
      - 'curl'
      - 'Invoke-WebRequest'
      - 'iwr '
      - 'wget'
      - 'mshta http'
      - 'node '
  condition: selection_parent and selection_child and selection_cmd
falsepositives:
  - Admin provisioning scripts (rare from browser parent)
level: critical
tags:
  - attack.initial_access
  - attack.t1204.001
  - attack.t1059

// Woodgnat Campaign Hunt: Node.js abuse + EtherHiding C2 + known IOCs
// Microsoft Sentinel / Defender XDR — run over last 90 days
let WoodgnatIOCs = dynamic(["94.156.114.250","178.16.55.232","mueleer.com","grande-luna.top","oeannon.com","authorized-logins.net","www.xt24.com"]);
let BlockchainRPC = dynamic(["mainnet.gateway.tenderly.co","bsc-dataseed","rpc.ankr.com","mainnet.infura.io"]);
let NodeNet = DeviceNetworkEvents
| where Timestamp > ago(90d)
| where InitiatingProcessFileName =~ "node.exe"
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl;
let EtherHiding = DeviceNetworkEvents
| where Timestamp > ago(90d)
| where RemoteUrl has_any (BlockchainRPC)
| where InitiatingProcessFileName in~ ("node.exe","powershell.exe","mshta.exe","rundll32.exe","wscript.exe","cscript.exe")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl;
let IOCMatch = DeviceNetworkEvents
| where Timestamp > ago(90d)
| where RemoteIP in (WoodgnatIOCs) or RemoteUrl has_any (WoodgnatIOCs)
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl;
let NodeProc = DeviceProcessEvents
| where Timestamp > ago(90d)
| where FileName =~ "node.exe"
| where ProcessCommandLine has_any ("\\Users\\Public\\","\\AppData\\Local\\Temp\\","\\AppData\\Roaming\\"," -e ")
| where not (FolderPath has "\\Program Files\\" and InitiatingProcessFileName in~ ("msiexec.exe","npm.cmd"))
| project Timestamp, DeviceName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine;
union NodeNet, EtherHiding, IOCMatch, NodeProc
| sort by Timestamp desc

# Woodgnat / AsukaStealer / ModeloRAT IOC Hunt Script
# Checks: network IOCs, suspicious node.exe processes, persistence artifacts, staged payloads
# Run elevated on suspected hosts or deploy via your EDR/remote shell at scale

$report = @()

# 1. Live connections to known Woodgnat C2
$c2 = @("94.156.114.250","178.16.55.232")
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | Where-Object {
    $c2 -contains $_.RemoteAddress
} | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $report += "[C2-HIT] $($_.RemoteAddress):$($_.RemotePort) <- $($proc.ProcessName) (PID $($_.OwningProcess))"
}

# 2. Suspicious node.exe processes (user-writable paths / inline eval)
Get-CimInstance Win32_Process -Filter "Name='node.exe'" | Where-Object {
    $_.CommandLine -match 'Users\\Public|AppData\\Local\\Temp|AppData\\Roaming| -e '
} | ForEach-Object {
    $report += "[NODE-SUS] PID $($_.ProcessId): $($_.CommandLine)"
}

# 3. DNS cache check for campaign domains
$domains = @("mueleer.com","grande-luna.top","oeannon.com","authorized-logins.net","xt24.com")
Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $name = $_.Entry; $domains | Where-Object { $name -like "*$_*" }
} | ForEach-Object { $report += "[DNS-HIT] $($_.Entry) -> $($_.Data)" }

# 4. Persistence: Run keys with suspicious updater-style names
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($key in $runKeys) {
    Get-ItemProperty $key -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match 'node\.exe|\.js|AppData|Users\\Public' -and
            $_.Name -notmatch '^PS'
        } | ForEach-Object { $report += "[RUNKEY] $($key): $($_.Name) = $($_.Value)" }
    }
}

# 5. Scheduled tasks invoking node.exe or .js payloads
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $actions = $_.Actions | Where-Object {
        $_.Execute -match 'node\.exe|wscript|cscript|mshta' -or $_.Arguments -match '\.js'
    }
    if ($actions) { $report += "[TASK] $($_.TaskName): $($actions.Execute) $($actions.Arguments)" }
}

# 6. Staged JavaScript payloads in common drop locations
$dropPaths = @("$env:PUBLIC","$env:TEMP","$env:APPDATA","$env:ProgramData")
foreach ($p in $dropPaths) {
    Get-ChildItem $p -Recurse -Include *.js -ErrorAction SilentlyContinue -Depth 2 |
        Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-120) } |
        ForEach-Object { $report += "[JS-FILE] $($_.FullName) (Modified: $($_.LastWriteTime))" }
}

if ($report.Count -eq 0) { Write-Output "[+] No Woodgnat artifacts found on $env:COMPUTERNAME" }
else {
    Write-Output "[!] $($report.Count) indicator(s) found on $env:COMPUTERNAME"
    $report | ForEach-Object { Write-Output $_ }
    $report | Out-File "$env:TEMP\woodgnat_hunt_$(Get-Date -Format 'yyyyMMdd_HHmm').txt"
}

Response Priorities

Immediate (0–4 hours)

• Block the C2 IPs (94.156.114.250, 178.16.55.232) and malicious domains (mueleer.com, grande-luna.top, oeannon.com, authorized-logins.net, xt24.com) at DNS sinkhole, proxy, and egress firewall.
• Deploy the Sigma and KQL detections above; retro-hunt 90 days (campaign active since February 2026).
• Alert — do not block — on non-browser connections to blockchain RPC gateways like mainnet.gateway.tenderly.co (EtherHiding).
• Inventory where node.exe exists in your environment; flag any instance on non-developer endpoints as suspicious by default.

24 Hours

• Credential exposure response: AsukaStealer's presence means any confirmed infection = assume full browser credential, cookie, and token compromise. Force password resets and revoke all active sessions/tokens (Entra ID, Google Workspace, VPN, SaaS) for affected users — session cookies bypass MFA.
• Identity verification: Review sign-in logs for affected accounts over the past 90 days; look for impossible travel, token replay, and new MFA device registrations.
• Dark web check: Search stealer-log marketplaces and breach channels for your corporate domains; prioritize resetting any credentials appearing in logs even if no endpoint infection is confirmed.
• Isolate any host with confirmed node.exe payload execution and acquire memory + disk images before remediation — access broker intrusions often precede ransomware deployment.

1 Week

• Application control: Restrict node.exe execution via WDAC/AppLocker to approved paths and signer-verified enterprise applications; alert on execution outside Program Files.
• User hardening: Brief staff on ClickFix lures — legitimate sites will never ask users to paste commands into the Run dialog. Add this to phishing simulations.
• Egress architecture: Implement category-based blocking of newly registered domains and suspicious TLDs; require proxy TLS inspection for script interpreters.
• Detection coverage: Extend EtherHiding behavioral detection to macOS/Linux endpoints — Node.js abuse is cross-platform and Woodgnat has already demonstrated adaptive delivery.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub