NodeSnake RAT: Interlock Ransomware Invests Heavily in Custom Tooling

Researchers discovered two actively developed NodeSnake RAT variants used by the Interlock ransomware group; NodeSnake is a custom Node.js remote access trojan that employs modular components, custom obfuscation, live debugging, and Cloudflare Tunnel-based C2 to evade detection and adapt to high-value targets such as higher education and government networks. The report emphasizes Interlock’s shift toward bespoke tooling for precision and persistence, describes operational impacts and evasion techniques, and recommends strengthening defenses like network segmentation, least privilege, MFA, and application controls to raise attacker costs.