Symantec’s Threat Hunter Team published research this week on a campaign, active since February 2026, in which an initial access broker tracked as Woodgnat (also known as KongTuke) downloads the legitimate, digitally signed Node.js runtime and uses it to execute malicious JavaScript payloads rather than compiled malware binaries. Symantec says Woodgnat has supplied initial access to multiple ransomware operations, including Qilin, Interlock, Rhysida, Akira, 8Base, Black Basta and Embargo, making it a supplier to several of the ransomware families security teams already track individually rather than a standalone threat.
Symantec explained the appeal of the technique plainly: “node.exe (the binary that runs Node.js) is a legitimate, signed developer tool. The attacker’s malicious code lives in interpreted scripts rather than in a binary, making it less likely to trigger signature-based detection.” Targets span government departments, technology and fintech firms, hotels, insurance, education and professional services, concentrated in Asia with confirmed incidents in the United States. Persistence is established through Windows registry Run keys, and in at least one case the group used “EtherHiding,” retrieving command-and-control instructions hidden inside Ethereum smart contracts, to make its infrastructure harder to take down.
The original insight is what Woodgnat represents structurally: an initial-access-as-a-service layer feeding at least seven distinct ransomware brands from one detection blind spot. Security teams that tune detections around each ransomware family’s individual toolkit will keep missing the access broker feeding all of them until the payload stage. The more durable control is behavioral: flag node.exe execution from unusual parent processes or non-developer endpoints, regardless of which ransomware brand eventually shows up downstream, since the runtime itself is the constant across every affiliate this broker sells access to.
Related: how one ransomware brand’s victim count kept climbing past 500 organizations and a separate incident that shows how far a single initial-access failure can cascade.
