Node.js Process Initiating Network Connection via Port 2222

nomit vyas@xoxo

•updated Jun 25, 2026•0•0•5

Detects Node.js processes initiating network connections to remote destination port 2222. This specific port and behavior pattern are known to be used by the Miasma botnet as a fallback C2 channel or for SSH-based remote access when standard communication ports are blocked or monitored.