The Ransomware Trick Your Security Software Can’t See. One of the simplest ways to protect your PC is with security software, but what happens when the hackers find a way to sneakily bypass this?
A lot of the malware campaigns we cover on Ophtek usually involve a suspicious download or a dodgy email attachment. But this latest attack does things a little differently. It uses Node.js, a tool built for developers, to carry out its attack. Most security software wouldn’t bat an eyelid at activity from Node.js. And this is what makes it such a clever attack.
The Attack That Doesn’t Look Like One
Node.js is typically used for developers to run JavaScript code outside of a web browser. It’s a legitimate tool – with security certificates to prove it – and used all over the internet by millions of developers. The average PC user is unlikely to have heard of Node.js, making it highly efficient at going undetected.
The campaign, which has been active since at least February 2026, begins when the hackers install Node.js on compromised computers. With this in place, the attackers then use it to run hidden malicious scripts in the background. As this is taking place under the cover of genuine software, antivirus tools are unlikely to flag it as suspicious.
Victims included hotels, government organizations, and tech companies across Asia and the United States. This highlighted the fact that the hackers didn’t appear to have a specific group in their sights. The nature of the attack also seemed to vary. One account saw Node.js running code which hid its instructions within the Ethereum blockchain. Another found a backdoor being installed in a US fintech firm that opened it up to several major ransomware gangs.
The attack was also persistent. To make sure the malware kept coming back, they coded a small instruction into the Windows Registry to always reload when someone logged into the PC.
What Can You Do To Protect Your Network?
The good news is that, despite its persistence and strength, this attack doesn’t need to leave your network and data in ruins. By implementing our three top tips, you can secure your defenses and keep attacks like this at bay:
- Keep Your Security Software Updated: This may sound obvious, but it’s genuinely important. As attacks like this one are reported, antivirus tools are updated to flag them. If you fail to install security updates, you’re essentially leaving your front door open for attackers.
- Unusual Software Should Always Be Scrutinized: If you spot a piece of software running on your PC that you don’t recognize, you should always investigate. Running a quick Google search on its name should let you know whether it should be on your PC or not e.g. a specialist coding tool such as Node.js which has no relevance to you or your organization.
- Implement DNS Filtering: As some of the attacks above involved connecting to blockchain networks, it’s important that you have a DNS filtering solution installed. This will help your IT team detect and block any suspicious connections before they take hold of your PC.
For more ways to secure and optimize your business technology, contact your local IT professionals.
