Node.js Suspicious Port 2222 Connection

Ibrahim Saud@tektrix

•updated Jun 17, 2026•3•0•10

Detects Node.js initiating connections over port 2222. This is used by the Miasma botnet as a fallback C2/SSH channel when standard ports are blocked.