Node.js RAT C2 rotation via repeated Polygon resolution + WS panel switch

Ibrahim Saud@tektrix

•updated Sep 22, 2026•1•0•5

Detects Node.js processes exhibiting network activity patterns consistent with 'EtherHiding' style C2 infrastructure, characterized by multiple distinct connections to external WebSocket hosts on non-standard TCP ports within a short timeframe, potentially following interaction with a blockchain/JSON-RPC endpoint.