Zscaler's "NodeCordRAT Discovery": We Published This Pattern 6 Weeks Ago

The Claim

Today, Zscaler ThreatLabz announced they "uncovered NodeCordRAT exploiting supply chain vulnerabilities via NPM."

• Hidden in NPM packages
• Steals browser credentials
• Steals API secrets
• Steals cryptocurrency wallet data
• C2 communication via Discord

Groundbreaking stuff. Except we published this exact pattern on November 25, 2025.

---

The Receipts

Our Publication Timeline

Zscaler's Publication

Six weeks later. Same TTPs. New name.

---

TTP Comparison

It's the same thing. They just gave it a catchy name.

---

How Did They "Find" It?

We publish a free STIX 2.1 feed at https://analytics.dugganusa.com/api/v1/stix-feed.

We publish IOCs to AlienVault OTX at https://otx.alienvault.com/user/pduggusa.

Our feed gets scraped. Constantly. We see the traffic.

Zscaler's threat intel team subscribes to threat feeds. That's not speculation - that's how threat intel works. You aggregate sources, correlate, and publish.

The question is: do you credit your sources?

---

What We Actually Published (November 25, 2025)

From our Stealc/Rhadamanthys analysis:

"The Stealc/Rhadamanthys payload steals:
- Browser passwords (Chrome, Firefox, Edge, Brave)
- Crypto wallets (MetaMask, Exodus, Coinbase, 40+ others)
- Discord tokens (account takeover)
- Telegram sessions
- VPN configs
- FTP credentials
- SSH keys
- 2FA backup codes"

• The exact credential categories
• The Discord C2 mechanism
• The supply chain delivery via package managers
• The social engineering patterns

In November.

---

The Math Your CFO Should See

What Zscaler Charges

Zscaler's market cap: $25 billion.

What We Charge

Our market cap: Two guys in Minnesota.

The Arbitrage

• Analysis we published 6 weeks earlier
• IOCs from our free STIX feed
• Patterns we documented in public blog posts

1. Subscribe to our free STIX feed directly
2. Integrate with your existing SIEM
3. Save $420,000/year
4. Buy your security team a pizza party

Or keep paying Zscaler to rebrand free intel with a "ThreatLabz" watermark.

Where The Money Actually Goes

They spend more on marketing than most companies spend on everything.

---

Why This Matters

This isn't about credit. It's about the economics of threat intelligence.

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

1. Small shops do the work - We run Pattern 38 detection daily at 06:00 UTC
2. We publish free IOCs - STIX feed, OTX pulses, blog posts with hashes
3. Vendors scrape the feeds - That's fine, that's what they're for
4. Vendors rebrand and publish - "Zscaler ThreatLabz has uncovered..."
5. Enterprise customers pay vendors - Not the people who found it

We're a two-person shop in Minnesota. Zscaler is a $25 billion company.

They have a marketing department that can turn "we read someone's STIX feed" into "ThreatLabz has uncovered."

---

The Pattern

This isn't the first time. It won't be the last.

• CrowdStrike
• Mandiant
• Palo Alto Unit 42
• Zscaler ThreatLabz
• Microsoft MSTIC

• Free feeds (like ours)
• Paid feeds
• Customer telemetry
• Government sharing

Then they publish under their brand as "discoveries."

The value isn't in finding the malware. It's in having the marketing budget to announce it.

---

What We're Not Saying

1. Saw similar activity in their customer telemetry
2. Correlated with public threat feeds (including ours)
3. Wrote it up with a catchy name
4. Published with their logo

That's legitimate threat intel work.

What's annoying is the framing: "ThreatLabz has uncovered..."

You didn't uncover it. You confirmed it. Six weeks after we published the full analysis.

---

The Receipts Are Public

All of our research is timestamped and public:

• Blog: https://www.dugganusa.com
• STIX Feed: https://analytics.dugganusa.com/api/v1/stix-feed
• OTX: https://otx.alienvault.com/user/pduggusa

Anyone can verify the dates. The blockchain doesn't lie, and neither do web archive timestamps.

---

Recommendation

If you're a threat intel consumer:

1. Subscribe to primary sources - Not just vendor blogs
2. Check publication dates - Who published first?
3. Follow independent researchers - We exist, and we publish free
4. Question "discoveries" - Most are correlations of existing intel

If you're Zscaler:

1. Credit your sources - "Corroborating research from DugganUSA..."
2. Or don't - But we'll keep publishing receipts

---

IOCs (The Ones We Published in November)

# Stealc/Rhadamanthys - Pattern 38 (November 2025)
# Full IOC list at: https://analytics.dugganusa.com/api/v1/stix-feed

---

Patrick Duggan is founder of DugganUSA LLC. We publish free threat intelligence because defenders shouldn't have to pay for IOCs. If you find our research useful, consider that before you "uncover" it six weeks later.

TLP:WHITE - Share freely. Credit appreciated but not required (unlike some vendors, we don't pretend to discover things we read in feeds).

---

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=zscaler-s-nodecordrat-discovery-we-published-this-pattern-6-weeks-ago