NodeSnakeRAT

NodeSnakeRAT is a JavaScript-based remote access implant associated with Interlock ransomware intrusions. It has been described as an early version of the malware tracked by Mandiant as CORNFLAKE and by Quorum as NodeSnakeRAT.B. In reported Interlock attack chains, MintLoader delivers a legitimate Node.js runtime (node.exe) that executes the malicious JavaScript payload, after which NodeSnakeRAT is used to establish access and support lateral movement across victim networks. Fortinet reporting states that Interlock has used this implant in attacks against education-sector organizations in the United States, the United Kingdom, and in at least one reported North American education intrusion.

Observed behavior includes execution via a bundled legitimate Node.js runtime, persistence through an autorun entry named ChromeUpdater, and use of embedded command-and-control infrastructure. Reported NodeSnakeRAT/CORNFLAKE C2 indicators include 216[.]245.184.181, 212[.]237.217.182, 168[.]119.96.41, and several trycloudflare.com subdomains. In one documented case, the initial JavaScript payload was j1wp4vw8.log with SHA1 63FD5E0811C0BCC7DF9FC3D712F39F829A8D6FF0. The malware was delivered in a zip archive named download.zip containing node.exe, following a PowerShell download cradle from 138[.]199[.]156[.]22:8080/<time_since_epoch>. The content directly links NodeSnakeRAT to Interlock operations involving post-compromise movement, with subsequent activity in those intrusions including use of valid accounts, living-off-the-land techniques, data exfiltration, and eventual ransomware deployment on Windows endpoints and Nutanix environments.