First Observed: August 31, 2026
Threat Type: Remote Access Trojan
Platform: Windows
Confidence: High
ChainScript
ChainScript is a Node.js remote access trojan delivered through malicious MSI installers masquerading as multiple legitimate software, including Spotify, Zoom Workplace, and Microsoft Teams, under confirmed personas including ComponentTask33 and UpdateDigital. Explore its key TTPs, associated tooling, indicators of compromise, and recommendations for defending Windows environments.
About This Threat Profile
Description of ChainScript
ChainScript is a Node.js remote access trojan delivered through malicious MSI installers masquerading as multiple legitimate software, including Spotify, Zoom Workplace, and Microsoft Teams, under confirmed personas including ComponentTask33 and UpdateDigital. Hidden PowerShell and VBScript stages launch a bundled Node.js agent that provides interactive CMD and PowerShell shells, file management, screenshots, secondary payload deployment, wallet discovery, remote JavaScript loading, and self-update. Rather than relying on a fixed C2 address, ChainScript resolves its active WebSocket panel at runtime through a Polygon smart contract, letting the operator relocate infrastructure without rebuilding or redistributing deployed implants.
ChainScript reflects an emerging pattern of malware using development frameworks and blockchain based C2 discovery to enable infrastructure rotation and complicate traditional indicator-based detection.
Key TTPs
ChainScript activity maps to the following MITRE ATT&CK techniques observed by the Blackpoint Adversary Pursuit Group (APG).
| Tactic | Technique | ATT&CK ID |
|---|---|---|
| Execution | Command and Scripting Interpreter: JavaScript | T1059.001 |
| Execution | Command and Scripting Interpreter: Visual Basic | T1059.005 |
| Execution | Command and Scripting Interpreter: JavaScript | T1059.007 |
| Persistence | Scheduled Task/Job: Scheduled Task | T1053.005 |
| Persistence | Boot or Logon Autostart Execution: Registry Run Keys | T1547.001 |
| Defense Impairment | Masquerading | T1036 |
| Discovery | System Information Discovery | T1082 |
| Collection | Screen Capture | T1113 |
| Command and Control | Application Layer Protocol: Web Protocols | T1071.001 |
| Command and Control | Web Service: Dead Drop Resolver | T1102.001 |
Tooling & Family Links
Blackpoint APG observed ChainScript alongside the following tooling, related families, and legitimate software abused during the intrusion chain.
| Tool / Family | Role |
|---|---|
| node-pty | Legitimate terminal library abused to provide ChainScript’s interactive CMD and PowerShell shell sessions. |
Indicators of Compromise
Organizations investigating potential ChainScript activity should review the following indicators identified by Blackpoint APG.
| Type | Value |
|---|---|
| ChainScript MSI | ComponentTask33-4d14e6ac.msi | 20a9e297220fe4cb9f939eaa82582c6e9a8f6dd4424635206dec08fa1986b8fa |
| ChainScript MSI | UpdateDigital-0c3c5204.msi | 6e07d2de3618bb92265248653361ff39c63c0cfba2f4aa2538b3128fa9ce3a50 |
| ChainScript Helper | ProfileQuickHost.exe | 9fa80577b8b3cb9c3062e5e1986cc9fe0c26eed023f7d430dfa5c60169c15c45 |
| ChainScript Helper | SearchTrustedRuntimeSvc.exe | 7969ccaf1db750bc3b02d51626d6916ecbd0c0cf2f7de3c7bc0be240f5f2978d |
| ChainScript C2 | shift-api-control[.]com:3847 |
| ChainScript C2 | bedotiq[.]net:3854 |
| ChainScript C2 (contextual) | moweros[.]net:3851 |
| ChainScript C2 Resolver Contract | 0xf9099d0d747368cce8C10226CC9AF2bFD4DDbCF4 (Polygon, chain ID 137, selector 0x4ab7874e) |
| ChainScript Launcher | ._agent.vbs, launched via wscript.exe //B |
| ChainScript State File | connect-delay-state.json |
Recommendations
- Hunt the execution lineage: msiexec.exe followed by hidden PowerShell or wscript.exe, then a user-space node.exe executing app\src\index.js. This relationship is more durable than build-specific installer names such as ComponentTask33 or UpdateDigital.
- Monitor user-writable Node.js runtimes launched from %LOCALAPPDATA%, %APPDATA%, or Microsoft-looking subdirectories when Node.js is not part of an approved developer or application workflow.
- Hunt for stable local artifacts such as ._agent.vbs and connect-delay-state.json, treating scatter-installer scripts and decoy folder names as variant indicators rather than required family markers.
- Alert on scheduled tasks or HKCU Run values that launch wscript.exe or Node.js from user profile directories.
- Correlate blockchain RPC activity with follow-on WebSocket connections, particularly when a non-browser process queries an RPC provider and then connects to a newly registered or uncommon domain.
- Treat detections as a full remote-access compromise: isolate affected systems, preserve artifacts, rotate exposed credentials, and reimage where appropriate.
Additional ChainScript Research
For a deeper analysis of ChainScript, read Blackpoint Cybers ChainScript: Tracing a Node.js RAT Through the Blockchain.
Additional references:
DATE PUBLISHEDNovember 12, 2026
AUTHORBlackpoint Cyber
SHARE ON
The Cost of Waiting
What Identity Attacks Cost the MSP Stolen credentials don't trip alarms. Once an attacker is authenticated, they look like anyone else, and most tools aren't watching what happens next. Learn what closing the identity response gap looks like: how identity attacks happen, where response slows down, and the questions to ask any ITDR vendor.
*Identity-based techniques play a role in nearly 90% of incident investigations