TonRAT Node.js Implant Campaign — Photo-Themed ZIP/.LNK Lures Target Hospitality Sector for Persistent Access (Waves 1 & 2) — Threadlinqs Intelligence
As of 2026-06-26, TonRAT Node.js Implant Campaign — Photo-Themed ZIP/.LNK Lures Target Hospitality Sector for Persistent Access (Waves 1 & 2) is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 36 indicators of compromise.
Threat ID: TL-2026-0946 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Microsoft tracks a multi-stage, financially-flavored intrusion campaign (Waves 1 & 2, April–June 2026) targeting hotels and the broader hospitality sector across Europe and Asia. Photo-themed ZIP
Microsoft Threat Intelligence reported on 2026-06-25 an active, evolving campaign against the hospitality/hotel industry in Europe and Asia, observed in two distinct waves: Wave 1 (April–May 2026) and Wave 2 (late May–June 2026). The campaign opens with social-engineering email lures themed around hotel guest complaints, bedbug (Cimex) infestation reports, verification-call notices, room-condition inquiries, and stay-review requests, delivered in Japanese, Danish, and Dutch. In the later phase the actor performs 'authentication laundering' by abusing Calendly's email-notification system (account em1618.calendly.com, display name 'Booking Manager (via Calendly)') so that SPF, DKIM (SendGrid-signed), DMARC, and CompAuth all pass, then chains Calendly and Google share redirects (calendly.com/url?q= -> share.google -> www.google.com/share_google -> photo-<digits>.cfd) to a Cloudflare-Turnstile-gated phishing landing page.
Victims receive a photo-<random>.zip archive containing a masqueraded shortcut named IMG-<random>.png.lnk (Wave 1) or PHOTO-<random>.png.lnk (Wave 2), sized 1,989–2,079 bytes from a consistent builder. Execution launches obfuscated PowerShell that uses a BigInt-based byte decoder. Microsoft documented a seven-phase obfuscation evolution: (1) XOR BigInt decoding (-bxor, -band 0xFF, -shr 8); (2) subtraction replacing XOR; (3) hex-to-decimal (-band 255); (4) arithmetic masking (-band (177+78)); (5) modulo/division extraction (% 256, / 256); (6) syntax diversification ("num" -as [bigint], randomized long variable names); and (7) a for-loop variant introduced in Wave 2. The decoder reconstructs an Invoke-WebRequest (iwr) downloader that stages a .ps1 in %TEMP%.
In Wave 2 the downloaded PowerShell compiles a .NET DLL on the host via csc.exe -> cvtres.exe (e.g. qFWe908J.ps1 419 KB -> bjygtujc.dll 3,072 bytes); the DLL was not observed being loaded via rundll32/regsvr32 in telemetry. All waves download the legitimate Node.js runtime (node-v24.13.0-win-x64, 89.9 MB) from nodejs.org and deploy the TonRAT implant as a randomly named .js under C:\Users\<user>\AppData\Local\Nodejs\, executed as 'node.exe <RANDOM>.js <C2_DOMAIN>'. TonRAT self-persists by spawning a detached child process via Node child_process.spawn({detached:true, stdio:'ignore', windowsHide:true}).unref().
Defense evasion includes Add-MpPreference -ExclusionProcess for Temp-resident executables. A PE payload (detected as Wacatac/PureRat, 'TonRAT' family) is dropped via an is-*.tmp installer (/SL5 or /VERYSILENT), relocated to C:\ProgramData\<RANDOM>\<lowercase>.exe, and persisted under HKCU\...\RunOnce with a randomized value (e.g. zZBPZPuA) that refreshes each run ('RunOnce loop'), while the Node.js implant persists under HKCU\...\Run. The dual-persistence model is resilient: when Defender blocked the PE (xmnrwv9l.exe), the Node.js Run key survived and resumed C2 after ~2 days with new payloads. C2 spans Wave 1 IPs (178.16.54.27 — persistent across both waves, 95.217.97.121, 193.202.84.32, 178.16.55.179) and a Wave 2 Cloudflare-fronted IP (172.67.161.215) over non-standard ports (8443, 8445, 8453, 5555, 56001–56003), with dozens of rotating .info/.com/.pro/.xyz/.cloud/.icu/.sbs domains in Wave 1 and added .cfd/.click/.bond domains (2–3 day lifespan) in Wave 2. Post-compromise activity includes ip-api.com geolocation lookups, headless --no-sandbox browser automation, and disruptive forced shutdowns (cmd /c shutdown -s -t 0). Targeting concentrates on guest-facing accounts (reception, frontdesk, reservations, accueil, recepcja, recepce, frontoffice). Cross-wave correlation (shared PE hash 04ec44f2..., shared domain sec-safe-dc.info, preserved C2 ports 56001–56003, identical Node.js version) confirms a single campaign. Microsoft has not attributed the activity to a known actor; the disciplined chain refinement and persistence investment suggest preparation for follow-on operations.
Target sectors: hospitality, hotels, travel
Target regions: Europe, Asia
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 36 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
MALWARE, HIGH, threat intelligence, cybersecurity, T1583, T1583, T1584, T1566, T1566, T1199, T1204, T1059, T1059, T1547