Search — “node”

Layer3 Intel reported six IP addresses on AS2650 (reserved for the Executive Office of the President) were used as residential proxy exit nodes by 28 proxy services between October 5 and November 3. Synthient attributes the traffic to Windows 11 machines running the InfaticaSDK, implying end-user devices on the network are infected with a proxy SDK. Hunters can look for InfaticaSDK-related network activity from Windows endpoints and unexpected residential proxy egress from enterprise address space.

Cisco updated its advisory for CVE-2026-111497, an out-of-bounds write in Google's Brotli library described as exploited, now affecting 19 Cisco products with more under investigation, and also says it has fixed CVE-2026-76506 in UCS Central. WatchGuard published advisories including critical AuthPoint Authentication Gateway authentication flaws, while Dimension remains unpatched. SonicWall says it will not fix CVE-2026-109593 (unauthenticated file read) and CVE-2026-109594 (SQL injection) in end-of-life GMS. The source does not describe any huntable attacker behavior or indicators for these flaws.

CERT-In reports an active AI-assisted actor, Crafty Falcon, using offensive AI tools (ARTEX, PentAGI, Cairn, CyberStrikeAI) against Indian BFSI, fintech and crypto firms, stealing payment gateway/partner-bank API credentials and invoking fund-transfer APIs from victims' allow-listed infrastructure, with theft of keys and funds reported. Tactics include web shells via file-upload/deserialization chains in PHP and Node.js apps, stolen static API tokens, plaintext creds in configs, micro-value test transactions, log deletion and endpoint security tampering. Separately, a copycat ARTEX GitHub repo pulls the backdoored Docker image tomicdd/artex, whose login handler runs a CAPTCHA field beginning with a secret marker through sh -c as root; 62 internet consoles served it. Hunt for web shells, anomalous fund-transfer/settlement API calls and Rs.1 test transactions, log clearing, and any deployment of artex images.

Krebs on Security, citing Layer3 Intel and Synthient, reports that residential proxy nodes beaconed from the Executive Office of the President network (AS2650) and exited from it 236 times between October 5 and November 3. Layer3 Intel says 28 residential proxy services could exit through this network, and Synthient links the activity to Windows 11 installations of Infatica, an SDK-embedded proxy program. The sources describe a proxy-abuse exposure rather than an intrusion, so hunters should look for unexpected residential proxy software and SDK-bundled applications on government endpoints.

Blockchain infrastructure provider Chainstack disclosed that an external attacker entered via a third-party component, reached a development environment on October 26, 2026, and then pivoted into parts of production. The company says the intrusion was detected and access cut on October 31, 2026, and that a database with organization names, account holder names, member emails and password hashes was accessed. Chainstack says there is no evidence node credentials were read but treats them as exposed; defenders should hunt for the access path, and customers are advised to rotate node credentials and API keys and reset passwords.

Since Oct 30, 2026, VulnCheck has observed attackers exploiting CVE-2026-58115, a CVSS 10 missing-authentication flaw in the Node-RED HTTP interface on Siemens SIMATIC IoT2050 Advanced devices. A single HTTP request deploys and auto-triggers a malicious flow that runs a shell wrapper using wget (curl fallback) to fetch a Linux bot to /dev/shm/.b or /tmp/.kworker and execute it. Other requests plant persistent webshells: an HTTP in endpoint (e.g. /cmd) wired to an exec node that runs commands from a query parameter. SecurityWeek reports VulnCheck called the exploitation successful; hunt for wget/curl/sh spawned by the Node-RED process, hidden files in /dev/shm and /tmp, and unexpected exec nodes or HTTP endpoints in deployed flows.

VulnCheck observed attackers, from October 30, 2026, exploiting CVE-2026-58115 (CVSS 10.0), a missing-authentication flaw in the Node-RED HTTP interface on SIMATIC IoT2050 Advanced devices, against its honeypots. The exploit deploys and auto-triggers a malicious Node-RED flow that runs a shell wrapper using wget (with curl as fallback) to fetch a Linux bot to /dev/shm/.b or /tmp/.kworker and execute it. Other requests create HTTP-in endpoints (e.g. /cmd) wired to exec nodes as a persistent command backdoor. Observations are from honeypots; no confirmed victim compromises are reported. Hunt for Node-RED spawning sh/wget/curl, new flows deployed via the admin API, and executables in /dev/shm or /tmp hidden files.

CrowdStrike's blog announces product and corporate moves for AI security, including planned acquisitions of Dreadnode and Fiddler, a Falcon Guardian AI kill switch that cuts model access at AI gateways, and pre-beta runtime protection inside the VM where Claude Cowork executes. The source is a vendor product announcement with no reported threat actor, malware, or intrusion. Defenders evaluating AI agent tooling may look at Falcon Guardian's agent discovery and runtime visibility, but the post contains no adversary behaviors to hunt.

VulnCheck reports in-the-wild exploitation of CVE-2026-58115, a CVSS 10 missing-authentication bug in the Node-RED HTTP interface, first observed October 30 from a single IP in AS8075. The attacker deployed a Node-RED flow that was triggered automatically and pulled a Linux bot binary from an attacker-controlled server. By November 1, VulnCheck saw 15 more attacks from the same IP delivering persistent webshells. Hunters should look for Node-RED instances without adminAuth reachable from outside, and for unexpected exec nodes or HTTP endpoints in deployed flows.

Huntress observed incidents where phishing lures (fake DocuSign proposal installer, fake Teams calendar link) led victims to install Hexnode MDM components or enroll into an attacker-controlled Rippling MDM tenant. The attackers then used the MDM path to install ScreenConnect connecting to attacker relays on port 8041, reinstalling it after removal. Hunt for unexpected MDM enrollments/agents (C:\Rippling\daemon.exe, Hexnode Gateway/agent with PostgreSQL), ScreenConnect installs spawned by MDM agents as SYSTEM, and outbound connections to unfamiliar relays on 8041.

CISA added Adobe Commerce/Magento PolyShell file-upload flaw and Google Brotli Node2Shell decoder flaw to KEV on Oct 27, 2026 (due Nov 10). Sansec reports PolyShell used to breach hundreds of stores, injecting a malicious loader via a Magento CMS block that fetches and executes an attacker payload; no next-stage malware recovered. Brotli exploit attempts seen on honeypots, including public Node2Shell exploit traffic from 94.154.43[.]7. Hunt for unexpected file uploads/web shells and modified CMS blocks in Magento, and Node.js processes spawning shells or crashing after Brotli-encoded requests.

Researcher Erica Windisch published the Tailworm report describing lab tests in which an attacker controlling one Tailscale device could use SSH port forwarding to reach root on other reachable servers, with the claims resting on her report alone. Tailscale has acknowledged the report and is investigating, but has issued no CVE, bulletin, or fixed version, and the proof-of-concept is not public. Hunters should review Tailscale SSH grants and port-forwarding use, and look for forwarding to Unix sockets and tailscale serve forwards pointing at Unix sockets.

A Brotli decoder out-of-bounds write (CVE-2026-111497, dubbed Node2Shell) affects Brotli 1.0.3 through 1.2.0 and has been patched by Node.js, Microsoft (.NET, Visual Studio, PowerShell), PyPI Brotli and brotlicffi, Bun, Envoy and Istio. Imperva demonstrated code execution on the official Node.js 24.22.0 Linux arm64 image, but its exploit is not public and SecurityWeek reports no exploitation in the wild. Hunters should inventory software that bundles Brotli and prioritize patching, since running processes keep the vulnerable code until restarted or rebuilt.

Huntress tracked a ten-week campaign (Jul 14–Sep 22, 2026) where AiTM relays and device-code phishing captured post-MFA M365 sessions, then replayed tokens from 193.26.115.0/24 (1337 Services GmbH, AS210558), yielding 497 successful sign-ins at 79 orgs. Persistence came via rogue Entra devices named DESKTOP-+8 uppercase hex, wiped-and-replaced MFA methods, and hidden inbox rules with short/punctuation names used for BEC/payroll fraud. Hunt for OAuth2:Token/Cmsi:Cmsi sign-ins with node or bare Mozilla/5.0 UA from hosting IPs, Device Registration Service sign-ins, MFA wipe+re-register within minutes, and inbox rules moving mail to RSS Feeds/Conversation History.

Imperva demonstrated attacker-supplied code execution on an official Node.js 24.22.0 Linux arm64 image by feeding crafted Brotli data to the bundled decoder, tracked as CVE-2026-111497. Exposure paths named are Node's built-in fetch() reading Brotli-compressed responses and Express 5 body parsers (express.json, urlencoded, text, raw) decoding Brotli request bodies. Node.js released fixes on October 21; the fixed 24.22.1 rejected the same data, and no in-the-wild exploitation had been reported as of October 22. Hunters should focus on patch inventory, including container images bundling Node, rather than published behaviors, since the sources print no attack commands or detection queries.

Huntress observed a sponsored Google ad for "amazon business" leading to a spoofed Amazon login on Google Sites with a fake CAPTCHA that pastes an obfuscated command into the Windows Run dialog. The command runs finger.exe against grillrecipespro[.]com, executing a .plan script that uses curl and tar to fetch IronPython, then ipyw32.exe loads Doina, a Node.js loader in C:\ProgramData\NodeView, Lumma Stealer via process hollowing, and a pirated NetSupport client in C:\ProgramData\Prodclear talking to 167.148.201[.]106:725. Hunt for finger.exe executions and outbound 79/tcp, curl/tar/ipyw32.exe chains from the Run dialog, node.exe running from ProgramData, and NetSupport traffic on 725/tcp.

Node.js released security updates on October 21, 2026 for its 22.x, 24.x and 26.x lines, fixing 10 flaws including CVE-2026-111497, an out-of-bounds write in the bundled Brotli decoder that the project says could allow remote code execution. A public proof-of-concept reached code execution only on a deliberately weakened test build; on a standard build it produced a crash and a limited memory read, and no in-the-wild exploitation had been reported as of October 22. Exposure is where an application decompresses attacker-controlled Brotli data, such as request bodies or fetch() responses, and there is no workaround, so hunters should focus on patch status and on Brotli-decoding services rather than on attack artifacts.

The brief item describes an npm package named imgdecode that conceals a Windows loader inside a native Node.js addon and pulls shellcode from GitHub. Defenders are told to check for a MicrosoftEdgeUpdateService scheduled task or service. The only linked source is an unrelated Hacker News article about identity exposure and attack paths, which contains no technical details of this campaign, so the technical claims rest solely on the brief.