Sapphire Sleet - Detached Hidden Node.js Process Execution

Georg Lauenstein@gsec

•updated Jun 21, 2026•1•0•13

Detects execution of detached hidden Node.js processes created by the Sapphire Sleet dropper. The malware spawns second-stage payloads as fully detached, window-hidden Node.js processes with randomly named .js files to evade detection and maintain persistence.