TonRAT Node.js Implant Campaign — Photo-Themed ZIP/.LNK Lures Target Hospitality Sector for Persistent Access (Waves 1 & 2)
TonRAT Node.js Implant Campaign (TL-2026-0946), also tracked as Photo ZIP Campaign, is a high-severity malware campaign, first published 2026-06-25. It has no confirmed attribution, affects Microsoft Windows (hospitality-sector endpoints), maps to 17 MITRE ATT&CK techniques (T1016, T1027, T1036), and is covered by 9 detection rules and 36 indicators of compromise.
Key facts for TL-2026-0946
- Threat ID
- TL-2026-0946
- Also known as
- Photo ZIP Campaign, TonRAT Campaign, Hospitality Photo ZIP Intrusion
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-25
- Last reviewed
- 2026-06-25
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- hospitality, hotels, travel
- Target regions
- Europe, Asia
- Detection rules
- 9
- Indicators of compromise
- 36
Malware and tooling in TonRAT Node.js Implant Campaign
Malware and tooling: TonRAT
Microsoft tracks a multi-stage, financially-flavored intrusion campaign (Waves 1 & 2, April–June 2026) targeting hotels and the broader hospitality sector across Europe and Asia. Photo-themed ZIP archives and fake image shortcut (.lnk) files deliver multi-phase obfuscated PowerShell that downloads a Node.js runtime and the TonRAT JavaScript implant, establishing dual HKCU Run/RunOnce registry persistence and C2 over non-standard ports. The campaign is unattributed.
How TonRAT Node.js Implant Campaign works
Microsoft Threat Intelligence reported on 2026-06-25 an active, evolving campaign against the hospitality/hotel industry in Europe and Asia, observed in two distinct waves: Wave 1 (April–May 2026) and Wave 2 (late May–June 2026). The campaign opens with social-engineering email lures themed around hotel guest complaints, bedbug (Cimex) infestation reports, verification-call notices, room-condition inquiries, and stay-review requests, delivered in Japanese, Danish, and Dutch. In the later phase the actor performs 'authentication laundering' by abusing Calendly's email-notification system (account em1618.calendly.com, display name 'Booking Manager (via Calendly)') so that SPF, DKIM (SendGrid-signed), DMARC, and CompAuth all pass, then chains Calendly and Google share redirects (calendly.com/url?q= -> share.google -> www.google.com/share_google -> photo-<digits>.cfd) to a Cloudflare-Turnstile-gated phishing landing page.
Victims receive a photo-<random>.zip archive containing a masqueraded shortcut named IMG-<random>.png.lnk (Wave 1) or PHOTO-<random>.png.lnk (Wave 2), sized 1,989–2,079 bytes from a consistent builder. Execution launches obfuscated PowerShell that uses a BigInt-based byte decoder. Microsoft documented a seven-phase obfuscation evolution: (1) XOR BigInt decoding (-bxor, -band 0xFF, -shr 8); (2) subtraction replacing XOR; (3) hex-to-decimal (-band 255); (4) arithmetic masking (-band (177+78)); (5) modulo/division extraction (% 256, / 256); (6) syntax diversification ("num" -as [bigint], randomized long variable names); and (7) a for-loop variant introduced in Wave 2. The decoder reconstructs an Invoke-WebRequest (iwr) downloader that stages a .ps1 in %TEMP%.
In Wave 2 the downloaded PowerShell compiles a .NET DLL on the host via csc.exe -> cvtres.exe (e.g. qFWe908J.ps1 419 KB -> bjygtujc.dll 3,072 bytes); the DLL was not observed being loaded via rundll32/regsvr32 in telemetry. All waves download the legitimate Node.js runtime (node-v24.13.0-win-x64, 89.9 MB) from nodejs.org and deploy the TonRAT implant as a randomly named .js under C:\Users\<user>\AppData\Local\Nodejs\, executed as 'node.exe <RANDOM>.js <C2_DOMAIN>'. TonRAT self-persists by spawning a detached child process via Node child_process.spawn({detached:true, stdio:'ignore', windowsHide:true}).unref().
Defense evasion includes Add-MpPreference -ExclusionProcess for Temp-resident executables. A PE payload (detected as Wacatac/PureRat, 'TonRAT' family) is dropped via an is-*.tmp installer (/SL5 or /VERYSILENT), relocated to C:\ProgramData\<RANDOM>\<lowercase>.exe, and persisted under HKCU\...\RunOnce with a randomized value (e.g. zZBPZPuA) that refreshes each run ('RunOnce loop'), while the Node.js implant persists under HKCU\...\Run. The dual-persistence model is resilient: when Defender blocked the PE (xmnrwv9l.exe), the Node.js Run key survived and resumed C2 after ~2 days with new payloads. C2 spans Wave 1 IPs (178.16.54.27 — persistent across both waves, 95.217.97.121, 193.202.84.32, 178.16.55.179) and a Wave 2 Cloudflare-fronted IP (172.67.161.215) over non-standard ports (8443, 8445, 8453, 5555, 56001–56003), with dozens of rotating .info/.com/.pro/.xyz/.cloud/.icu/.sbs domains in Wave 1 and added .cfd/.click/.bond domains (2–3 day lifespan) in Wave 2. Post-compromise activity includes ip-api.com geolocation lookups, headless --no-sandbox browser automation, and disruptive forced shutdowns (cmd /c shutdown -s -t 0). Targeting concentrates on guest-facing accounts (reception, frontdesk, reservations, accueil, recepcja, recepce, frontoffice). Cross-wave correlation (shared PE hash 04ec44f2..., shared domain sec-safe-dc.info, preserved C2 ports 56001–56003, identical Node.js version) confirms a single campaign. Microsoft has not attributed the activity to a known actor; the disciplined chain refinement and persistence investment suggest preparation for follow-on operations.
MITRE ATT&CK techniques used in TL-2026-0946
Discovery
T1016 System Network Configuration Discovery; T1614 System Location Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1127 Trusted Developer Utilities Proxy Execution
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1571 Non-Standard Port
Initial Access
T1199 Trusted Relationship; T1566 Phishing
Impact
Persistence
T1547 Boot or Logon Autostart Execution
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure
defense-impairment
Affected products and versions in TonRAT Node.js Implant Campaign
- Microsoft — Windows (hospitality-sector endpoints)
Vulnerable versions: Windows endpoints with PowerShell and user-writable AppData/ProgramData - OpenJS Foundation — Node.js (abused as legitimate runtime)
Vulnerable versions: v24.13.0-win-x64 (used as living-off-trusted-software host for TonRAT)
Remediation for TonRAT Node.js Implant Campaign
Immediate actions
- Remove BOTH persistence mechanisms: delete the HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce value pointing to C:\ProgramData\<RANDOM>\<lowercase>.exe and the HKCU\...\Run value pointing to the Node.js runtime.
- Delete the Node.js runtime and TonRAT payload from C:\Users\<user>\AppData\Local\Nodejs\ (node.exe and the random .js file).
- Hunt for and remove ProgramData payloads (C:\ProgramData\<RANDOM>\<lowercase>.exe) and Temp executables added as Defender exclusions.
- Block C2 IPs (178.16.54.27, 95.217.97.121, 193.202.84.32, 178.16.55.179, 172.67.161.215) and non-standard ports (8443, 8445, 8453, 5555, 56001-56003) at the perimeter; sinkhole/block the listed .info/.cfd/.bond/.pro domains.
- Isolate front-desk/reservation/reception endpoints showing node.exe executing .js from AppData\Local\Nodejs\.
Workarounds
- Configure mail filtering to scrutinize Calendly-originated notifications and share.google/google share_google redirect links.
- Block inbound archives containing .lnk files masquerading as .png images; alert on double-extension (*.png.lnk) shortcuts.
- Alert on csc.exe spawning cvtres.exe and DLL creation in user-writable paths from PowerShell.
Longer-term hardening
- Deploy EDR with behavioral detection and enable Microsoft Defender Tamper Protection to prevent Add-MpPreference exclusion abuse.
- Enable Attack Surface Reduction rules to block execution of obfuscated/script content and shortcut-launched scripts.
- Enforce PowerShell Constrained Language Mode and enable script-block/module logging.
- Restrict or monitor unauthorized Node.js runtime deployment in user-writable paths.
- Deliver hospitality-sector phishing awareness covering Calendly-spoofed booking/guest-complaint lures and photo-themed ZIP attachments.
Timeline of TonRAT Node.js Implant Campaign
- Wave 1 begins (April 2026): photo-themed ZIP archives deliver IMG-<random>.png.lnk shortcuts launching obfuscated PowerShell that downloads the legitimate Node.js runtime and the TonRAT implant. Hospitality/hotel targets across Europe and Asia, with guest-complaint and bedbug lures in Japanese, Danish, and Dutch.
- Throughout Wave 1 the actor iteratively refines the BigInt-based PowerShell decoder across obfuscation phases 1-6 (XOR -> subtraction -> hex-to-decimal -> arithmetic masking -> modulo/division -> syntax diversification with randomized long variable names) — incremental detection evasion rather than wholesale tradecraft change.
- In late May the actor adopts Calendly-based 'authentication laundering' (account em1618.calendly.com, display name 'Booking Manager (via Calendly)') so SPF/DKIM(SendGrid)/DMARC/CompAuth all pass, chaining Calendly/Google share redirects to photo-<digits>.cfd Turnstile-gated landing pages.
- Wave 2 begins (late May 2026): LNK naming shifts to PHOTO-<random>.png.lnk, PowerShell adds a for-loop obfuscation variant (phase 7), and the chain inserts csc.exe/cvtres.exe compile-after-delivery .NET DLL creation (e.g. qFWe908J.ps1 -> bjygtujc.dll) before Node.js deployment.
- Cloudflare-fronted Wave 2 C2 domain photo-26654.cfd registered (observed ~17 days old at the time of Microsoft's analysis), consistent with the Wave 2 pattern of short-lived (2-3 day) .cfd/.click/.bond rotation domains.
- Wave 2 operates Cloudflare-fronted .cfd/.click/.bond C2 domains (front IP 172.67.161.215) with 2-3 day lifespans; cross-wave anchors IP 178.16.54.27 (ports 56001/56002) and domain sec-safe-dc.info persist across both waves.
- After Defender blocked the PE payload xmnrwv9l.exe, the surviving HKCU\Run Node.js implant resumed C2 ~2 days later, delivering new payloads (e.g. cBA8H4S5k04jAY.exe) — demonstrating dual-persistence (Run + RunOnce) resilience.
- Post-compromise, TonRAT performs host profiling and geolocation lookups against ip-api.com (resolved via 208.95.112.1), runs headless --no-sandbox browser automation, and in some cases issues disruptive forced shutdowns (cmd /c shutdown -s -t 0).
- Microsoft Threat Intelligence publicly disclosed the campaign, documenting Waves 1 & 2, the seven-phase PowerShell obfuscation evolution, the TonRAT Node.js implant, the dual-persistence model, and the full IOC set. No attribution made.
Sources cited for TonRAT Node.js Implant Campaign
- Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access
- MITRE ATT&CK T1204.002 — User Execution: Malicious File
- MITRE ATT&CK T1059.001 — Command and Scripting Interpreter: PowerShell
- MITRE ATT&CK T1547.001 — Registry Run Keys / Startup Folder
- MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools
- Node.js official downloads (legitimate runtime abused by TonRAT)
Threats related to TonRAT Node.js Implant Campaign
- Photo ZIP Phishing Campaign Delivering TonRAT via Node.js Abuse Targeting Hospitality Sector
- Photo ZIP Campaign Delivers TonRAT Node.js Implant to Hospitality Sector via Authentication Laundering
- TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry
- Node.js Living-off-the-Land: Multiple Threat Actors Abuse Signed node.exe as a Script Interpreter, Feeding Ransomware Access Brokers
- Malicious Windows Shortcuts (LNK) Deploy Node.js Backdoor via PowerShell and TON Blockchain C2 (EtherHiding-style)
- Fake GitHub 'EQVita' Homebrew Repo Delivers SmartLoader and Lumma Stealer to the Retro Gaming / PlayStation Vita Modding Community
Detection coverage for TL-2026-0946
As of 2026-06-25, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0946 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0946
5 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.