Node.js Suspicious Port 2222 Connection

nomit vyas@xoxo

•updated Jun 21, 2026•0•0•3

Detects Node.js initiating network connections over port 2222. This activity is associated with the Miasma botnet, which uses port 2222 as a fallback C2/SSH channel when standard ports are blocked.