RoadK1ll Implant Uses WebSocket Tunnels to Pivot Through Breached Networks
Summary
Blackpoint says it found RoadK1ll, a Node.js implant that uses an outbound WebSocket tunnel to relay TCP traffic and help operators pivot from a compromised host to internal systems.
Key points
- Blackpoint discovered RoadK1ll during an incident response engagement.
- The Node.js implant opens an outbound WebSocket connection to attacker-controlled infrastructure rather than listening for inbound connections.
- Its CONNECT and DATA commands let operators open TCP connections to internal hosts and relay traffic through the compromised machine.
- RoadK1ll supports multiple concurrent connections over one tunnel and attempts to reconnect if the channel is interrupted.
- Blackpoint says the implant has no traditional persistence mechanism and runs only while its process remains active.
- Blackpoint published limited host-based indicators, including a hash and an operator IP address.
Article Details
- Attack Vectors
- RoadK1ll establishes an outbound WebSocket connection to attacker-controlled infrastructure, creating a reverse tunnel without an inbound listener on the compromised host.
- The implant forwards TCP traffic on demand, allowing an operator to connect through the compromised host to internal systems and services.
- RoadK1ll supports multiple concurrent connections over one tunnel and attempts to reconnect if the channel is interrupted.
- The implant operates only while its process remains alive and lacks traditional persistence mechanisms such as registry keys, scheduled tasks, or services.
MITRE ATT&CK
T1071.001 · Web ProtocolsThe implant communicates with attacker-controlled infrastructure over a custom WebSocket protocol.T1090.001 · Internal ProxyRoadK1ll turns a compromised host into an internal relay for connections to otherwise unreachable network systems.T1572 · Protocol TunnelingRoadK1ll tunnels TCP traffic through a custom WebSocket connection to reach internal systems.