Miasma: Node.js Cloud Credential Harvest or Exfil to 85.137.53.71

Duo Tech@duotech

•updated Jul 15, 2026•2•0•1

This rule detects node.js processes that either attempt to read sensitive cloud credential or configuration files (AWS, Google Cloud, Azure) or establish network connections to a specific remote IP address (85.137.53.71) on ports 8080 or 8081. This behavior is indicative of credential theft or potential command and control (C2) activity from a compromised node environment.