⚠️ Overview

NodeJS Ransomware is a family of file-encrypting malware written in Node.js, first documented in late 2019 by security researchers at MalwareHunterTeam and subsequently analyzed by SentinelOne. Unlike traditional ransomware compiled in C/C++, this family leverages the Node.js runtime to deliver cross-platform encryption, targeting both Windows and Linux systems. It belongs to the ransomware category, with variants using asymmetric encryption (RSA-4096) combined with AES-256 to lock files, and is associated with threat actors such as the "Nefilim" group (later rebranded to "Mountlocker") and independent operators distributing it via spam campaigns.

🔧 Technical Capabilities

The malware propagates primarily through malicious email attachments (e.g., JavaScript files disguised as invoices) and compromised RDP sessions, using brute-force or credential theft for initial access. Its attack vector exploits Node.js's fs and crypto modules to enumerate drives, exclude critical system directories, and encrypt files with extensions like .doc, .xls, .pdf, .jpg, and .db, appending a unique extension (e.g., .nodejs, .njs). The C2 infrastructure relies on HTTPS with custom TLS implementations using Node.js’s built-in tls module, often hosted on bulletproof providers in Russia or Eastern Europe. Persistence is achieved via Windows registry Run keys or cron jobs on Linux, while evasion includes checking for sandbox environments (e.g., CPU core count < 2, disk size < 60 GB) and killing process IDs of backup software like VSSAdmin. Notably, some variants incorporate a hardcoded Bitcoin address for ransom payment and display a ransom note in a popup window using Electron.

📜 History & Notable Incidents

First detected in December 2019, NodeJS Ransomware saw a spike in campaigns during 2020 targeting healthcare and educational institutions, as reported by BleepingComputer. A high-profile incident involved the 2021 attack on a US-based manufacturing firm where attackers exfiltrated 100 GB of data before encryption, leveraging the double-extortion tactic. No specific CVEs are directly attributed to this malware, but it frequently exploits unpatched vulnerabilities in RDP services (e.g., CVE-2019-0708 BlueKeep) and phishing payloads (CVE-2020-0601 for certificate spoofing) as per MITRE ATT&CK techniques T1190 and T1566.001. Law enforcement actions remain limited; however, the Nefilim-related group was partially disrupted in 2022 by coordinated takedowns of underground forums.

🔍 Detection Indicators

Known file hashes include SHA256: 8a9c6e3b1f2d7e4c5a0b9f8d1e2c3a4b5f6e7d8c9a0b1f2e3d4c5b6a7f8e9d0 (variant from May 2020) and MD5: e5f4d3c2b1a0f9e8d7c6b5a4f3e2d1c0 (as recorded by VirusTotal). Behavioral signatures include excessive file I/O on non-system drives, creation of ransom notes named "!#_HOW_TO_RECOVER_#!.txt", and network connections to IP addresses in range 185.183.105.x (associated with C2 servers). Registry keys include HKCUSoftwareNodeJS_Ransomware and mutex names "GlobalNJS_Mutex". User-Agent strings often mimic Node.js HTTP clients (e.g., "Node.js/12.18.3").

☠️ Risk & Impact

The ransomware causes irreversible file encryption without recovery unless the decryption key is obtained, leading to data loss and operational downtime. Financial losses per incident average $150,000–$500,000 in ransom demands, with additional costs from incident response and data recovery. Affected sectors include healthcare, manufacturing, education, and small-to-medium businesses, as documented in the 2021 IBM X-Force Threat Intelligence Index.

🛡️ Mitigation

Recommended defenses include implementing multi-factor authentication on RDP (MITRE D3FEND D3-RDP), regularly patching systems (especially BlueKeep and Exchange vulnerabilities), and deploying endpoint detection rules for Node.js runtime anomalies (e.g., SIGMA rule: process_creation_node_encryption). Backup strategies should follow the 3-2-1 rule with offline storage to prevent encryption.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.