New RoadK1ll WebSocket implant used to pivot on breached networks

**RoadK1ll: Node.js WebSocket reverse-tunneling implant enabling stealthy lateral movement** Blackpoint identified a lightweight Node.js implant named RoadK1ll that establishes an outbound WebSocket tunnel to attacker infrastructure to relay TCP connections and pivot to internal hosts; it supports multiple concurrent proxied connections, automatic reconnection, and a small command set, but lacks built-in persistence. The report includes a hash and an IP IOC and highlights the implant's ability to inherit network trust and bypass perimeter controls.