# Photo ZIP Campaign Delivers TonRAT Node.js Implant to Hospitality Sector via Authentication Laundering

> An unattributed, multi-wave campaign (April-June 2026) targets hospitality/hotel front-desk staff across Europe and Asia with photo-themed ZIP archives containing fake image LNK shortcuts that trigger a seven-phase-obfuscated PowerShell decoder chain, ultimately deploying a Node.js-based implant (TonRAT) for persistent, dual-registry C2 access. The actor abuses Calendly notification infrastructure and Google URL redirects to launder phishing emails through legitimate SendGrid-backed infrastructure so they pass SPF/DKIM/DMARC/CompAuth checks.

- **Published:** 2026-07-16T00:00:00Z
- **Last reviewed:** 2026-07-16T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1406
- **ID:** TL-2026-1406
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Microsoft Defender Experts documented a two-wave campaign (Wave 1: April-May 2026; Wave 2: late May-June 2026) delivering a JavaScript/Node.js remote access implant tracked as TonRAT against hospitality-sector organizations (reception, front desk, reservations) in Europe and Asia. Victims receive high-volume, templated phishing emails (subjects themed around bedbug complaints, guest-safety warnings, and stay-review requests in Japanese, Danish, and Dutch) sent with the display name "Booking Manager (via Calendly)". Because the messages are relayed through a threat-actor-controlled Calendly account (em1618.calendly[.]com) riding on Calendly's SendGrid sending infrastructure, they pass SPF, DKIM, DMARC, and Microsoft's Composite Authentication (CompAuth) checks -- an authentication-laundering technique that abuses trusted third-party infrastructure (T1199) rather than any software vulnerability. Clicking the notification link routes the victim through a multi-hop redirect chain: calendly[.]com/url?q= -> share.google/TOKEN -> www.google.com/share_google?q= -> a Cloudflare Turnstile-gated photo-*.cfd landing page, which serves a browser-downloaded ZIP archive named photo-<digits>.zip. Inside is a fake image shortcut (IMG-<digits>.png.lnk in Wave 1, PHOTO-<digits>.png.lnk in Wave 2, both a consistent 1,989-2,079 bytes, indicating reuse of a single builder tool) that, when opened, launches heavily obfuscated PowerShell. The obfuscation evolved across seven observed phases -- from simple XOR-with-bigint, through subtraction-based decoding, hex-to-decimal conversion, arithmetic masking, modulo/division operations, randomized bigint-cast variable names, to a Wave-2 for-loop variant -- each phase designed to defeat static PowerShell signatures while recovering a staged .ps1 script written to %TEMP%. In Wave 1 the PowerShell directly downloads and launches the Node.js runtime; in Wave 2 it additionally compiles a small .NET DLL on-target via csc.exe/cvtres.exe before deploying Node.js, adding an extra evasion layer. The actor installs a legitimate, unmodified Node.js Windows binary (node-v24.13.0-win-x64, fetched from nodejs.org) into a user-writable path (%LOCALAPPDATA%\Nodejs) to avoid system dependencies, then launches it against a randomly named .js payload with the C2 domain as a command-line argument. Before this, the actor issues Add-MpPreference -ExclusionProcess to exempt Temp-staged EXEs from Defender scanning, and installer helper .tmp files run with /SL5 or /VERYSILENT silent-install flags. Persistence is dual-registry: an HKCU\...\Run entry points at the Node.js interpreter for long-term survival, while an HKCU\...\RunOnce entry points at a copy of the loader EXE relocated into a randomly-named C:\ProgramData subfolder -- and critically, the RunOnce value re-creates itself after each execution, defeating defenders who treat RunOnce entries as one-time and complicating cleanup. In one observed incident the Node.js Run-key persistence survived Defender blocking the initial ProgramData PE payload (detected as Wacatac), allowing C2 communication to resume two days later. Command-and-control uses a rotating stable of non-standard ports (8443, 8445, 8453, 5555, 56001-56003) against a primary IP (178.16.54[.]27) active across both waves plus several secondary IPs, alongside domains rotated roughly every 2-3 days across a wide range of TLDs (.info, .com, .pro, .xyz, .cloud, .icu, .sbs in Wave 1; .cfd, .click, .bond added in Wave 2 for Cloudflare fronting). Post-compromise behavior observed includes headless/no-sandbox browser automation, geolocation lookups via ip-api[.]com, and forced remote shutdown commands. Microsoft has not attributed the campaign to a known threat actor but assesses a single disciplined operator managing parallel delivery mechanisms with clear operational maturation (infrastructure expansion, evasion refinement, persistence-durability investment) across the two waves, suggesting preparation for follow-on activity beyond what has been observed to date. No CVE or software vulnerability is involved; the entire chain relies on social engineering and abuse of legitimate services (Calendly, Google redirects, Cloudflare, nodejs.org).

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1566.002 Spearphishing Link
- T1199 Trusted Relationship
- T1684.001 Impersonation
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1027 Obfuscated Files or Information
- T1027.004 Compile After Delivery
- T1036 Masquerading
- T1685 Disable or Modify Tools
- T1547.001 Registry Run Keys / Startup Folder
- T1016 System Network Configuration Discovery
- T1571 Non-Standard Port

## Sources

- [Photo ZIP campaign targeting hospitality industry delivers Node.js implant for persistent access](https://www.microsoft.com/en-us/security/blog/2026/06/25/photo-zip-campaign-targeting-hospitality-industry-delivers-node-js-implant-persistent-access/)
- [Malpedia: js.tonrat](https://malpedia.caad.fkie.fraunhofer.de/library/347b58ce-bf5a-4305-b175-9acddcbae735/)
- [MITRE ATT&CK T1199 - Trusted Relationship](https://attack.mitre.org/techniques/T1199/)
- [MITRE ATT&CK T1566.002 - Phishing: Spearphishing Link](https://attack.mitre.org/techniques/T1566/002/)
- [MITRE ATT&CK T1547.001 - Registry Run Keys / Startup Folder](https://attack.mitre.org/techniques/T1547/001/)
- [MITRE ATT&CK T1027.004 - Compile After Delivery](https://attack.mitre.org/techniques/T1027/004/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1406