Uploaded August 2026 | Updated September 2026, 15 minutes ago
Sven Rath (Check Point Research, AT)
Node.js has become a staple in the malware development toolkit of crimeware authors: it is easy to develop, trivial to obfuscate, and difficult to analyze — with a wide array of open‑source obfuscators, originally designed to protect intellectual property, commonly abused by threat actors to hide their malicious code.
This talk introduces a purpose‑built Node.js Tracer designed to cut through the noise by instrumenting the runtime rather than having to deal with tedious manual source‑code deobfuscation, ultimately saving precious time for analysts and incident responders. After an overview of different forms of Node.js malware observable in the wild, the talk reconstructs a malware research effort that sparked the tool’s development, outlines the mechanics of tracing as a dynamic reverse‑engineering method, and demonstrates how runtime hooking exposes the malware’s real behavior.
Attendees will see, using case studies of several real incidents, how the utility neutralizes anti‑analysis checks, bypasses obfuscation, and speeds up the analysis process — resulting in a practical workflow for incident response teams facing increasingly obfuscated JavaScript‑based malware families.
---
Sven Rath works as a Security Researcher at Check Point Research, spending most of his time hunting for emerging malware threats and reverse engineering different malware, from malicious Browser Extensions to Kernel Level Rootkits. After work, he spends his time researching Windows Kernel Internals and fringe malware techniques and writing blog posts about both.
Sven Rath (Check Point Research, AT)
Node.js has become a staple in the malware development toolkit of crimeware authors: it is easy to develop, trivial to obfuscate, and difficult to analyze — with a wide array of open‑source obfuscators, originally designed to protect intellectual property, commonly abused by threat actors to hide their malicious code.
This talk introduces a purpose‑built Node.js Tracer designed to cut through the noise by instrumenting the runtime rather than having to deal with tedious manual source‑code deobfuscation, ultimately saving precious time for analysts and incident responders. After an overview of different forms of Node.js malware observable in the wild, the talk reconstructs a malware research effort that sparked the tool’s development, outlines the mechanics of tracing as a dynamic reverse‑engineering method, and demonstrates how runtime hooking exposes the malware’s real behavior.
Attendees will see, using case studies of several real incidents, how the utility neutralizes anti‑analysis checks, bypasses obfuscation, and speeds up the analysis process — resulting in a practical workflow for incident response teams facing increasingly obfuscated JavaScript‑based malware families.
---
Sven Rath works as a Security Researcher at Check Point Research, spending most of his time hunting for emerging malware threats and reverse engineering different malware, from malicious Browser Extensions to Kernel Level Rootkits. After work, he spends his time researching Windows Kernel Internals and fringe malware techniques and writing blog posts about both.
