CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

NodeSnake

malware · malware:nodesnake single-source

Node.js-based remote-access trojan used by the Interlock/GOLD EMBRACE ransomware operation for persistence after ClickFix delivery, executed via a bundled node.exe launched from a scheduled task named to imitate the built-in Windows disk-defragmentation task (Sophos X-Ops, 2026-08-07).

Coverage
1
first 2026-08-10 → last 2026-08-10
Latest activity
2026-08-10
A ransomware operator acquired a memory image and ran hashdump and cachedump offline against it, leaving…
Peak priority
high
1 high
Targets
public-sector
sectors: public-sector, healthcare, energy · regions: europe
Sources cited
2
1 hosts

Defender insights

What each entry about NodeSnake tells a defender to do, newest first.

2026-08-10HIGHA ransomware operator acquired a memory image and ran hashdump and cachedump offline against it, leaving traces that look like an IR engagement

Triage

Relationships explore in graph

Typed, source-stated connections from the entity registry; each edge cites the entry whose reporting establishes it.

used by

Story timeline

  1. 2026-08-10Interlock ran Volatility3 and WinPmem against a live endpoint to harvest credentials, the responder's own memory-forensics toolkit used in place of a commodity dumper
    active-threatsA ransomware operator acquired a memory image and ran hashdump and cachedump offline against it, leaving traces that look like an IR engagement

Hunting pivots

Tags
identityorganized-crimephishingransomware
ATT&CK techniques (9 across 7 tactics)

9 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.1 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessDrive-by Compromise
  • ExecutionScheduled Task/Job: Scheduled Task · User Execution: Malicious Copy and Paste
  • PersistenceScheduled Task/Job: Scheduled Task · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • Privilege EscalationScheduled Task/Job: Scheduled Task · Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
  • Credential AccessOS Credential Dumping: Security Account Manager · OS Credential Dumping: Cached Domain Credentials · Steal or Forge Kerberos Tickets: Kerberoasting
  • DiscoveryPermission Groups Discovery: Domain Groups
  • Lateral MovementRemote Services: Remote Desktop Protocol

Initial Access TA0001

T1189Drive-by Compromise×1

Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. Multiple ways of delivering exploit code to a browser exist (i.e., Drive-by Target), including:

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

Execution TA0002

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

T1204.004User Execution: Malicious Copy and Paste×1

An adversary may rely upon a user copying and pasting code in order to gain execution. Users may be subjected to social engineering to get them to copy and paste code directly into a Command and Scripting Interpreter. One such strategy is "ClickFix," in which adversaries present users with seemingly helpful solutions (such as prompts to fix errors or complete CAPTCHAs) that instead instruct the user to copy and paste malicious code.

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

Persistence TA0003

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

Privilege Escalation TA0004

T1053.005Scheduled Task/Job: Scheduled Task×1

Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

T1547.001Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder×1

Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

Credential Access TA0006

T1003.002OS Credential Dumping: Security Account Manager×1

Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored. The SAM is a database file that contains local accounts for the host, typically those found with the <code>net user</code> command. Enumerating the SAM database requires SYSTEM level access.

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

T1003.005OS Credential Dumping: Cached Domain Credentials×1

Adversaries may attempt to access cached domain credentials used to allow authentication to occur in the event a domain controller is unavailable.

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

T1558.003Steal or Forge Kerberos Tickets: Kerberoasting×1

Adversaries may abuse a valid Kerberos ticket-granting ticket (TGT) or sniff network traffic to obtain a ticket-granting service (TGS) ticket that may be vulnerable to Brute Force.

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

Discovery TA0007

T1069.002Permission Groups Discovery: Domain Groups×1

Adversaries may attempt to find domain-level groups and permission settings. The knowledge of domain-level permission groups can help adversaries determine which groups exist and which users belong to a particular group. Adversaries may use this information to determine which users have elevated permissions, such as domain administrators.

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

Lateral Movement TA0008

T1021.001Remote Services: Remote Desktop Protocol×1

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-08-10/interlock-volatility3-winpmem-credential-theft · ATT&CK page ↗

Entries about NodeSnake (1)

2026-08-10 · view entry permalink →

HIGHNATOB2

Interlock ran Volatility3 and WinPmem against a live endpoint to harvest credentials, the responder's own memory-forensics toolkit used in place of a commodity dumper

Sophos's Emergency Incident Response team has published an intrusion in which the Interlock ransomware operator (which Sophos's Counter Threat Unit tracks as GOLD EMBRACE, active since September 2024 against North American and European targets) used the defender's own toolkit for credential access (Sophos X-Ops, 2026-08-07). On the first compromised host, the actor acquired a full physical-memory image using WinPmem, the open-source physical-memory acquisition tool, and then ran Volatility3's Windows plugins against that image offline: the hash-dump plugin to recover account material from the SAM and SYSTEM hive structures resident in memory, and the cached-domain-credential plugin for cached logons. No commodity credential dumper was involved in that step.

The chain around it is otherwise conventional and worth reading for its timing. The user reached a compromised but reputable site through a search result, and five seconds later the page read the clipboard, the ClickFix fingerprint. Eight seconds later, thirteen seconds into the chain, the user pasted an attacker-supplied command into the Run dialog, which fetched a second-stage script and installed a remote-access trojan to run at startup; registry Run-key persistence landed about twenty-five minutes in. The operator then paused for roughly a day before resuming with domain-group enumeration over LDAP, a service-principal-name query consistent with Kerberoasting, and a lateral move to the domain controller over RDP. On the third day, using a compromised domain-administrator account, persistence was re-established through a scheduled task named to imitate the built-in disk-defragmentation task and running a bundled Node.js interpreter. Sophos records the outcome as credential dumping including cloud credentials, access to sensitive files, new domain-administrator accounts, and tampering with endpoint protection, and notes that, across the estate, not all endpoints were in fact running protection of any sort.

The reason this is worth a defender's attention is not novelty of the malware but the inversion it forces. Memory acquisition and Volatility analysis are exactly what an incident responder does, so the on-host artifacts of the attack step and of a legitimate engagement are the same artifacts. Sophos is explicit that adversarial use "would leave similar traces" to a DFIR investigation, a security assessment, or malware analysis, and that what resolved it in this case was that the customer knew of no legitimate activity of that kind.

Triage: memory-acquisition and memory-analysis binaries executing on an endpoint are not anomalous by artifact; they are anomalous by authorisation and by context. The discriminators that survive are organisational rather than technical: whether an engagement, assessment or analysis was actually scheduled on that host at that time; whether the binaries arrived through the change process that normally delivers them or were dropped into a user-writable path; and whether the acquisition ran on a host with a current, unexplained persistence artifact and recent Run-key or scheduled-task creation. A memory image being written to disk by a process whose parent is a user shell or a downloaded stager, rather than by a responder's tooling deployed through management infrastructure, is the sequence worth alerting on.

In March 2026, the Sophos Emergency Incident Response (EIR) team investigated an incident in which we observed the use of the legitimate IR memory analysis tool Volatility3 by the ransomware threat actor Interlock.

Interlock, which Sophos Counter Threat Unit (CTU) researchers track as GOLD EMBRACE, emerged in September 2024.

We found evidence of credential dumping (including AWS credentials), access to sensitive files, addition of new domain-admin accounts, tampering with Defender on the endpoints, and more.

Sophos X-Ops 2026-08-07
threat10 Aug 04:44Zsingle-sourceOpen finding →
Sources: Sophos X-Ops · Sophos Counter Threat Unit

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • sophos.com2 (100%)
All cited sources (2)