A newly discovered piece of malicious software, RoadK1ll, lets attackers secretly move from one infected computer to others on the same network.

This malware, built using Node.js, uses a unique WebSocket protocol to keep the attacker connected and able to perform further actions.

Blackpoint, a managed detection and response company, found RoadK1ll while responding to a security incident.

Researchers describe it as a streamlined reverse tunneling tool that hides within normal network traffic, turning an infected device into a relay point for the attacker.

“Its only purpose is to transform a single compromised computer into a manageable access point, enhancing the attack by allowing the operator to pivot to internal systems, services, and network areas that would otherwise be inaccessible from outside the network’s security perimeter,” Blackpoint explains.

RoadK1ll doesn’t need to listen for incoming connections on the infected computer. Instead, it creates an outgoing WebSocket connection to infrastructure controlled by the attacker, which is then used as a tunnel to relay TCP traffic as needed.

This strategy lets the attacker stay hidden for longer and forward traffic to internal systems using just one WebSocket tunnel.

“The attacker can tell RoadK1ll to create connections to internal services, management interfaces, or other computers that are not directly exposed to the outside world,” Blackpoint notes.

“Because these connections originate from the compromised device, they take on its network privileges and position, bypassing security measures intended to protect the network’s edge.”

Additionally, RoadK1ll can handle several simultaneous connections over the same tunnel, enabling the operator to communicate with multiple targets at once.

The researchers say the malware accepts a small range of commands, including:

• CONNECT – Tells the implant to create a TCP connection to a specific computer and port
• DATA – Forwards regular data through an open connection
• CONNECTED – Confirms that a connection was successfully established
• CLOSE – Ends an active connection
• ERROR – Sends error information back to the operator

The CONNECT command does what RoadK1ll is primarily designed to do: start an outbound TCP connection to a nearby target, extending the attacker’s reach within the compromised network.

If the connection is lost, the tool tries to restore the WebSocket tunnel using a reconnection method, helping attackers maintain ongoing access without causing suspicion through manual actions.

However, Blackpoint points out that RoadK1ll lacks a typical persistence mechanism that uses registry keys, scheduled tasks, or services. It only works as long as its process remains running.

Despite this, the researchers believe the malware “demonstrates a more advanced and specifically designed way” of hiding communications making it adaptable, effective, and simple to deploy.

It also allows the attacker to gain access to internal systems and areas of the network that are unreachable from outside.

Blackpoint offers a small set of indicators of compromise that include a hash for RoadK1ll and an IP address used to communicate with the implant.