New RoadK1ll WebSocket implant used to pivot on breached networks

""Its sole function is to convert a single compromised machine into a controllable relay point, an access amplifier, through which an operator can pivot to internal systems, services, and network segments that would otherwise be unreachable from outside the perimeter.""

""The attacker can instruct RoadK1ll to open connections to internal services, management interfaces, or other hosts that are not directly exposed externally.""

""Because these connections originate from the compromised machine, they inherit its network trust and positioning, effectively bypassing perimeter controls.""

RoadK1ll is a newly identified Node.js malware that allows threat actors to move from a compromised host to other systems within a network. It operates over a custom WebSocket protocol, enabling ongoing access and further operations. Discovered by Blackpoint, it functions as a lightweight reverse tunneling implant, turning infected machines into relay points. RoadK1ll establishes outbound connections to attacker-controlled infrastructure, allowing attackers to bypass perimeter controls and communicate with internal services while remaining undetected.

Read at BleepingComputer