NodeRabbit is a cross-platform RAT developed using Node.js... More advanced variants introduce anti-analysis checks, corporate proxy support, expanded C2 capabilities, Outlook account discovery, and persistence through malicious Visual Studio Code extensions and Git hooks.
NodeRabbit
NodeRabbit is a cross-platform Node.js remote-access trojan attributed with high confidence to the Iran-linked cyberespionage group Mirage Kitten, also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore.
Profile source: Mallory opens in a new tabNodeRabbit
Family profile
NodeRabbit is a cross-platform Node.js remote-access trojan attributed with high confidence to the Iran-linked cyberespionage group Mirage Kitten, also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore. It targets Windows, Linux, and macOS developer workstations. The malware has been distributed through recruitment-themed spearphishing campaigns in which fake recruiter personas send software engineers trojanized coding assessments containing locally bundled malicious npm dependencies. Confirmed targeting includes fintech, aviation, and aerospace organizations in Afghanistan, Egypt, and Ethiopia.
NodeRabbit runs as a background process and uses AES-256-GCM-protected web communications for command-and-control. Its capabilities include host, network, process, directory, mounted-volume, and development-project discovery; arbitrary shell-command and supplied Node.js-script execution; file creation, modification, deletion, and retrieval; process management; and configurable beaconing. Later variants add enterprise proxy discovery and authenticated proxy tunneling, anti-analysis checks based on host resources, uptime, names, and analysis tools, and Outlook artifact discovery for local account-address collection. When analysis conditions are detected, it can terminate without contacting its command server.
NodeRabbit implements platform-specific persistence, including Windows autorun mechanisms or scheduled tasks, Linux cron, and macOS LaunchAgents. Advanced variants can install a counterfeit Visual Studio Code extension, attempt to disable Visual Studio Code Workspace Trust, and inject launchers into Git hooks so the implant is restarted during routine source-control operations. These features indicate a focus on durable access to software-development environments for espionage.
Capabilities
- Defense Evasion
- Persistence
- Post Exploitation
- Reconnaissance
Reported operators
Threat actors
3 named in public reportingNodeRabbit is a cross-platform RAT developed using Node.js... More advanced variants introduce anti-analysis checks, corporate proxy support, expanded C2 capabilities, Outlook account discovery, and persistence through malicious Visual Studio Code extensions and Git hooks.
NodeRabbit is a cross-platform RAT developed using Node.js... More advanced variants introduce anti-analysis checks, corporate proxy support, expanded C2 capabilities, Outlook account discovery, and persistence through malicious Visual Studio Code extensions and Git hooks.
MITRE ATT&CK
NodeRabbit in ATT&CK
42 distinct techniquesTechniques
42 techniques T1195.002 Compromise Software Supply Chain T1090.002 External Proxy T1083 File and Directory Discovery T1082 System Information Discovery T1059 Command and Scripting Interpreter T1057 Process Discovery T1547.001 Registry Run Keys / Startup Folder T1071.001 Web Protocols T1087.003 Email Account T1546 Event Triggered Execution T1573.001 Symmetric Cryptography T1497.001 System Checks T1059.007 JavaScript T1566.003 Spearphishing via Service T1036 Masquerading T1204.002 Malicious File T1562.001 Disable or Modify Tools T1105 Ingress Tool Transfer T1573 Encrypted Channel T1090 Proxy T1608.001 Upload Malware T1543.001 Launch Agent T1036.005 Match Legitimate Resource Name or Location T1588.002 Tool T1053.003 Cron T1518.001 Security Software Discovery T1497 Virtualization/Sandbox Evasion T1016 System Network Configuration Discovery T1053.005 Scheduled Task T1566.002 Spearphishing Link T1114.001 Local Email Collection T1005 Data from Local System T1041 Exfiltration Over C2 Channel T1546.013 PowerShell Profile T1070.004 File Deletion T1132.001 Standard Encoding T1219 Remote Access Tools T1008 Fallback Channels T1195 Supply Chain Compromise T1546.004 Unix Shell Configuration Modification T1059.004 Unix Shell T1176 Software Extensions
