RoadK1ll Malware Converts Compromised Systems Into Pivoting Relays

The Blackpoint Response Operations Center (BROC) has identified a newly discovered Node. js-based implant named RoadK1ll during a recent intrusion analysis.

Unlike traditional remote access trojans packed with large command sets, RoadK1ll serves a highly specific operational purpose. It is a lightweight reverse-tunneling tool that converts a single compromised machine into a controllable network relay.

Custom Protocol and Traffic Multiplexing

To achieve its operational goals, RoadK1ll bypasses standard tunneling frameworks and relies on a custom communication protocol.

The malware utilizes two core Node.js modules: the net module for raw TCP socket handling and the ws module for WebSocket communication. This architectural choice allows the implant to bridge the attacker’s remote command server and the victim’s internal network.

When establishing its outbound command tunnel, RoadK1ll connects to a predefined remote relay server using basic token authentication.

The communication relies on a custom message framing structure. Each message begins with a four-byte channel identifier, followed by a one-byte message type, and concludes with the payload data.

Message Type	Operational Functionality
DATA	Forwards raw traffic through an active network channel .
CONNECT	Instructs the implant to establish a new TCP connection .
CONNECTED	Confirms to the operator that the requested socket was established .
CLOSE	Signals that a specific communication channel should be terminated .
ERROR	Provides failure feedback and error reporting to the remote operator .

Lateral Movement and Connection Resilience

RoadK1ll transforms a standard network intrusion into a widespread threat through its pivoting capabilities. Once the WebSocket tunnel is active, the implant listens for inbound operator commands.

When the operator sends a CONNECT instruction, it provides a well-formed target host and port. RoadK1ll immediately initiates a new TCP connection to that internal destination directly from the compromised machine.

Because this new connection originates internally, it inherently bypasses perimeter security controls.

It inherits the compromised host’s network trust. This mechanism enables lateral movement, allowing attackers to access internal services, management interfaces, and segmented resources isolated from the public internet.

After the connection is verified, RoadK1ll acts as a bidirectional proxy. It forwards attacker traffic into the live internal socket and routes the returning data back through the WebSocket tunnel.

To maintain this critical access, RoadK1ll features a built-in reconnection loop.

If the WebSocket tunnel drops due to network interruptions, the malware automatically schedules a reconnection attempt based on a configured interval. The logic checks for active timers to prevent multiple overlapping connection attempts.

The implant lacks traditional persistence mechanisms like registry run keys, scheduled tasks, or service installations.

Instead, this loop ensures the Black Point Cyber implant recovers gracefully as long as the main process remains running. By focusing on modular network relay capabilities, it successfully turns a single endpoint into a reusable gateway.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.