Last seven days
- First activity
- Sep 2, 2026
- Last activity
- Sep 2, 2026
- Feed role
- C2
- Host form
- 0 IP / 38 hostnames
NodeRabbit
NodeRabbit is a Node.js-based cross-platform remote-access trojan attributed with high confidence to the Iranian-aligned Mirage Kitten group, also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore.
Profile source: Mallory opens in a new tabNodeRabbit
Family profile
NodeRabbit is a Node.js-based cross-platform remote-access trojan attributed with high confidence to the Iranian-aligned Mirage Kitten group, also tracked as UNC1549, Smoke Sandstorm, and Nimbus Manticore. It targets Windows, Linux, and macOS developer workstations, with confirmed activity against fintech, aviation, and aerospace targets in Afghanistan, Egypt, and Ethiopia. Operators distribute it through recruiter impersonation and recruitment-themed spearphishing on LinkedIn and job-search platforms, using trojanized coding-challenge projects that contain bundled malicious npm packages. NodeRabbit provides host, network, process, filesystem, and drive reconnaissance; executes shell commands and attacker-provided Node.js code; and can create, modify, delete, and collect files. Variants use encrypted web-based command-and-control, support proxy-aware communications, and include anti-analysis checks. Persistence is platform-specific and includes Windows autorun or scheduled-task mechanisms, Linux cron, and macOS LaunchAgents. One variant adds local Outlook artifact collection, fake Visual Studio Code extension persistence, and Git-hook injection, enabling continued access through developer workflows.
Capabilities
- Defense Evasion
- Exfiltration
- Persistence
- Post Exploitation
- Reconnaissance
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
23 Sep 1
Observed infrastructure
Leading locations
- US16
- NL6
- IE1
Leading providers
- Cloudflare, Inc.15
- Microsoft Corporation7
- Amazon.com, Inc.1
Infrastructure traits
- Hosting 23
- Anycast 15
Reported operators
Threat actors
3 named in public reportingNodeRabbit est un RAT multiplateforme (Windows, Linux, macOS) écrit en Node.js. Trois variantes ont été identifiées.
NodeRabbit is a remote-access trojan capable of infecting Windows, Linux and macOS systems. Once installed, it allows attackers to collect information about the victim and their computer, create or modify files and execute additional commands.
NodeRabbit is a remote-access trojan capable of infecting Windows, Linux and macOS systems. Once installed, it allows attackers to collect information about the victim and their computer, create or modify files and execute additional commands.
MITRE ATT&CK
NodeRabbit in ATT&CK
39 distinct techniquesTechniques
39 techniques T1090 Proxy T1608.001 Upload Malware T1543.001 Launch Agent T1082 System Information Discovery T1036.005 Match Legitimate Resource Name or Location T1588.002 Tool T1053.003 Cron T1518.001 Security Software Discovery T1497 Virtualization/Sandbox Evasion T1016 System Network Configuration Discovery T1053.005 Scheduled Task T1071.001 Web Protocols T1547.001 Registry Run Keys / Startup Folder T1566.002 Spearphishing Link T1114.001 Local Email Collection T1573.001 Symmetric Cryptography T1059.007 JavaScript T1083 File and Directory Discovery T1195.002 Compromise Software Supply Chain T1005 Data from Local System T1057 Process Discovery T1204.002 Malicious File T1041 Exfiltration Over C2 Channel T1566.003 Spearphishing via Service T1036 Masquerading T1546.013 PowerShell Profile T1070.004 File Deletion T1132.001 Standard Encoding T1219 Remote Access Tools T1546 Event Triggered Execution T1008 Fallback Channels T1573 Encrypted Channel T1497.001 System Checks T1195 Supply Chain Compromise T1562.001 Disable or Modify Tools T1546.004 Unix Shell Configuration Modification T1059.004 Unix Shell T1176 Software Extensions T1105 Ingress Tool Transfer
