Hackers Deploy RoadK1ll Pivoting Malware to Turn Compromised Hosts Into Network Relays

RoadK1ll is a lean, Node.js-based reverse-tunneling implant that creates an outbound WebSocket tunnel to attacker infrastructure, turning infected machines into stealthy relays for reaching internal systems. The report details a custom 5-byte-framed WebSocket protocol with multiple channel support, message types for DATA/CONNECT/CONNECTED/CLOSE/ERROR, persistence and reconnection behavior, and provides IoCs including Index.js, SHA256 b5a3ace8dc6cc03a5d83b2d85904d6e1ee00d4167eb3d04d4fb4f793c9903b7e, and C2 IP 45.63.39.209.