TONResolver RAT Uses TON Blockchain in Phishing Campaign Targeting Japanese Hotels
Summary
Trend Micro details a phishing campaign targeting Japanese Booking.com partner hotels. TONResolver runs through Node.js and retrieves its command server from a TON smart contract, allowing attackers to change destinations; observed follow-on activity involved browser-st
Key points
- Phishing emails impersonated guest complaints or review requests to trick Japanese hotel staff into downloading ZIP files and running LNK shortcuts disguised as photos.
- The LNK launched PowerShell, which retrieved scripts and deployed Node.js to run the obfuscated TONResolver RAT.
- TONResolver queried a TON smart contract via TonAPI for its C&C domain, letting attackers change servers without updating the malware.
- The RAT established encrypted WebSocket communications, sent endpoint details, persisted through a Windows Run key, and maintained a 20-second keepalive while awaiting commands.
- Trend Micro observed follow-on activity accessing Chrome and Edge browser data folders and involving lsass.exe, raising suspicion of credential theft; the campaign was ongoing.
- Suggested defenses include restricting unnecessary access to TON platforms and monitoring or blocking suspicious PowerShell and Node.js activity.
Article Details
- Attack Vectors
- Phishing emails impersonated guest complaints and review requests to persuade employees of Japanese Booking.com partner companies to click links and open a malicious LNK file disguised as a photo inside a downloaded ZIP archive.
- In conversational attacks, an initial inquiry without a URL was followed by a reply-dependent email containing a malicious link; some messages were sent through Gmail.
- The LNK launched PowerShell to retrieve and execute a PS1 script, which deployed Node.js and ran the TONResolver JavaScript RAT.
- TONResolver retrieved its C&C domain from a TON smart contract via TonAPI, then communicated with the C&C server over WebSocket.
- Defensive Notes
- Restrict access to blockchain platforms, including tonapi[.]io, where business access is unnecessary.
- Use proxy-gateway connection filtering to restrict external communications, including PowerShell communications and User-Agents containing "Powershell".
- Monitor endpoint services and processes, establish baselines, and detect anomalies; TrendAI Vision One Workbench detects suspicious Node.js autorun activity.
- Review communication and application controls, strengthen monitoring, and reassess incident-response procedures.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | amanohuguta[.]cfd | Initial C&C server domain recorded in the TON contract on 2026-02-07. |
| DOMAIN | hsaertyuoang34[.]sbs | C&C server domain recorded in the TON contract on 2026-02-09. |
| DOMAIN | tonajukbhuakpo2[.]shop | C&C server domain recorded in the TON contract on 2026-06-02. |
| DOMAIN | zloapobikahy23[.]bond | C&C server domain recorded in the TON contract on 2026-02-20. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationTONResolver used VM-based obfuscation that impeded static analysis.T1036 · MasqueradingThe malicious LNK file was disguised as a photo file in the ZIP archive.T1059.001 · PowerShellThe LNK launched PowerShell to retrieve and execute a PS1 script.T1059.007 · JavaScriptNode.js executed the TONResolver JavaScript payload.T1071.001 · Web ProtocolsTONResolver communicated with its C&C server over WebSocket.T1102.001 · Dead Drop ResolverThe malware used a TON smart contract, queried through TonAPI, as a dead drop resolver for its changeable C&C domain.T1105 · Ingress Tool TransferPowerShell retrieved the PS1 script, and the infection chain downloaded Node.js for payload execution.T1204.002 · Malicious FileThe infection began when a user executed an LNK file disguised as a photo.T1547.001 · Registry Run Keys / Startup FolderDynamic analysis confirmed the malware checked and set persistence through the Windows Run key.T1566.002 · Spearphishing LinkPhishing emails delivered links to malicious websites hosting the ZIP payload.T1573.001 · Symmetric CryptographyThe malware encrypted C&C messages using AES-256-CBC.
People
Malware
Vendors
CloudflareThese observed domains abused Cloudflare’s infrastructure and used the Cloudflare Name Server pair “galilea” and “moura”.Googlefetch + https://google.comTrendAIIn this blog entry, TrendAI™ Research examines a wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and
Products
Booking.coma wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and characteristics of the malware involved.GmailMultiple email delivery methods were observed, including bulk phishing and interactive conversational attacks via Gmail that build initial trust before delivering a malicious URL.Node.jsSubsequently, concatenated string fragments define the folder under "%USERPROFILE%\AppData\Local\Nodejs" as the Node.js deployment location, and the subsequent JavaScript payload is saved to the same folder path.The Open Network (TON)Unlike conventional phishing campaigns, the malware abuses The Open Network (TON) blockchain platform as a dead drop resolver, a technique that allows attackers to update their command-and-control (C&C) serverTonAPIAdditionally, the following tonapi[.]io URL was identified among the Base64 strings and plaintext:TrendAI Apex OneTrendAI Vision OneAttack observation by TrendAI Vision One™ Services – Managed Detection and Response (MDR) TrendAI Vision One Threat Intelligence HubTrendAI Vision One Zero Trust Secure Access (ZTSA)