# TonRAT Node.js Implant Campaign — Photo-Themed ZIP/.LNK Lures Target Hospitality Sector for Persistent Access (Waves 1 & 2)

> Microsoft tracks a multi-stage, financially-flavored intrusion campaign (Waves 1 & 2, April–June 2026) targeting hotels and the broader hospitality sector across Europe and Asia. Photo-themed ZIP archives and fake image shortcut (.lnk) files deliver multi-phase obfuscated PowerShell that downloads a Node.js runtime and the TonRAT JavaScript implant, establishing dual HKCU Run/RunOnce registry persistence and C2 over non-standard ports. The campaign is unattributed.

- **Published:** 2026-06-25T00:00:00Z
- **Last reviewed:** 2026-06-25T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0946
- **ID:** TL-2026-0946
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Threat Intelligence reported on 2026-06-25 an active, evolving campaign against the hospitality/hotel industry in Europe and Asia, observed in two distinct waves: Wave 1 (April–May 2026) and Wave 2 (late May–June 2026). The campaign opens with social-engineering email lures themed around hotel guest complaints, bedbug (Cimex) infestation reports, verification-call notices, room-condition inquiries, and stay-review requests, delivered in Japanese, Danish, and Dutch. In the later phase the actor performs 'authentication laundering' by abusing Calendly's email-notification system (account em1618.calendly.com, display name 'Booking Manager (via Calendly)') so that SPF, DKIM (SendGrid-signed), DMARC, and CompAuth all pass, then chains Calendly and Google share redirects (calendly.com/url?q= -> share.google -> www.google.com/share_google -> photo-<digits>.cfd) to a Cloudflare-Turnstile-gated phishing landing page.

Victims receive a photo-<random>.zip archive containing a masqueraded shortcut named IMG-<random>.png.lnk (Wave 1) or PHOTO-<random>.png.lnk (Wave 2), sized 1,989–2,079 bytes from a consistent builder. Execution launches obfuscated PowerShell that uses a BigInt-based byte decoder. Microsoft documented a seven-phase obfuscation evolution: (1) XOR BigInt decoding (-bxor, -band 0xFF, -shr 8); (2) subtraction replacing XOR; (3) hex-to-decimal (-band 255); (4) arithmetic masking (-band (177+78)); (5) modulo/division extraction (% 256, / 256); (6) syntax diversification ("num" -as [bigint], randomized long variable names); and (7) a for-loop variant introduced in Wave 2. The decoder reconstructs an Invoke-WebRequest (iwr) downloader that stages a .ps1 in %TEMP%.

In Wave 2 the downloaded PowerShell compiles a .NET DLL on the host via csc.exe -> cvtres.exe (e.g. qFWe908J.ps1 419 KB -> bjygtujc.dll 3,072 bytes); the DLL was not observed being loaded via rundll32/regsvr32 in telemetry. All waves download the legitimate Node.js runtime (node-v24.13.0-win-x64, 89.9 MB) from nodejs.org and deploy the TonRAT implant as a randomly named .js under C:\Users\<user>\AppData\Local\Nodejs\, executed as 'node.exe <RANDOM>.js <C2_DOMAIN>'. TonRAT self-persists by spawning a detached child process via Node child_process.spawn({detached:true, stdio:'ignore', windowsHide:true}).unref().

Defense evasion includes Add-MpPreference -ExclusionProcess for Temp-resident executables. A PE payload (detected as Wacatac/PureRat, 'TonRAT' family) is dropped via an is-*.tmp installer (/SL5 or /VERYSILENT), relocated to C:\ProgramData\<RANDOM>\<lowercase>.exe, and persisted under HKCU\...\RunOnce with a randomized value (e.g. zZBPZPuA) that refreshes each run ('RunOnce loop'), while the Node.js implant persists under HKCU\...\Run. The dual-persistence model is resilient: when Defender blocked the PE (xmnrwv9l.exe), the Node.js Run key survived and resumed C2 after ~2 days with new payloads. C2 spans Wave 1 IPs (178.16.54.27 — persistent across both waves, 95.217.97.121, 193.202.84.32, 178.16.55.179) and a Wave 2 Cloudflare-fronted IP (172.67.161.215) over non-standard ports (8443, 8445, 8453, 5555, 56001–56003), with dozens of rotating .info/.com/.pro/.xyz/.cloud/.icu/.sbs domains in Wave 1 and added .cfd/.click/.bond domains (2–3 day lifespan) in Wave 2. Post-compromise activity includes ip-api.com geolocation lookups, headless --no-sandbox browser automation, and disruptive forced shutdowns (cmd /c shutdown -s -t 0). Targeting concentrates on guest-facing accounts (reception, frontdesk, reservations, accueil, recepcja, recepce, frontoffice). Cross-wave correlation (shared PE hash 04ec44f2..., shared domain sec-safe-dc.info, preserved C2 ports 56001–56003, identical Node.js version) confirms a single campaign. Microsoft has not attributed the activity to a known actor; the disciplined chain refinement and persistence investment suggest preparation for follow-on operations.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1584 Compromise Infrastructure
- T1566 Phishing
- T1199 Trusted Relationship
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1127 Trusted Developer Utilities Proxy Execution
- T1016 System Network Configuration Discovery
- T1614 System Location Discovery
- T1571 Non-Standard Port
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1529 System Shutdown/Reboot

## Sources

- [Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access](https://www.microsoft.com/en-us/security/blog/2026/06/25/photo-zip-campaign-targeting-hospitality-industry-delivers-node-js-implant-persistent-access/)
- [MITRE ATT&CK T1204.002 — User Execution: Malicious File](https://attack.mitre.org/techniques/T1204/002/)
- [MITRE ATT&CK T1059.001 — Command and Scripting Interpreter: PowerShell](https://attack.mitre.org/techniques/T1059/001/)
- [MITRE ATT&CK T1547.001 — Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001/)
- [MITRE ATT&CK T1562.001 — Impair Defenses: Disable or Modify Tools](https://attack.mitre.org/techniques/T1562/001/)
- [Node.js official downloads (legitimate runtime abused by TonRAT)](https://nodejs.org/en/download)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0946