# TonRAT Phishing Campaign Impersonating Booking.com Targets Hotel Industry

> A phishing campaign impersonating Booking.com Partner Support abused Calendly/SendGrid infrastructure and Google-shortened redirect links to deliver a JavaScript remote access trojan dubbed TonRAT (aka TONResolver) to hotel operator staff, primarily in Japan. TonRAT resolves its command-and-control domain dynamically via the TON blockchain (a 'dead drop resolver' pattern) and communicates over an AES/ECDH-encrypted WebSocket channel; the campaign has been tied to unauthorized access and modification of victim hotel bank account information, and impersonation activity is reportedly still ongoing.

- **Published:** 2026-08-28T00:00:00Z
- **Last reviewed:** 2026-08-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2175
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-tonrat-booking-com-hotel-phishing-tl-2026-2175.webp?v=4f601441 (Threadlinqs threat intel: TonRAT Targets Hotel Staff via Booking.com: Detection & IOCs (TL-2026-2175) — High severity, 21 IOCs, 9 detection rules.)
- **ID:** TL-2026-2175
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 21 (3 shown free below)

## Description

Between May and June 2026, ITOCHU Cyber & Intelligence identified a multi-stage phishing campaign impersonating Booking.com Partner Support and targeting Japanese hotel operating companies that partner with Booking.com. Rather than compromising Booking.com itself, the operators hijacked or spoofed the affiliate-support relationship and abused the Calendly scheduling platform's email-notification pipeline (routed through SendGrid, o3.sg.calendly[.]com / 149.72.248[.]16) to send phishing emails with attacker-controlled Reply-To addresses. Because the emails originated from Calendly's legitimate mail infrastructure, they were able to pass SPF/DKIM/DMARC checks that would normally flag a spoofed sender.

The emails contained Calendly links that redirected through a Google URL shortener to a malicious ZIP archive. The archive contained a Windows shortcut (.lnk) file disguised as a photo (double extension, e.g. 'PHOTO-819427133.png.lnk') alongside a decoy MP4. Opening the .lnk file silently launched an embedded PowerShell command that downloaded a second, obfuscated PowerShell script from an attacker-controlled '.cfd' domain (photo-26654[.]cfd and related photo-#####.cfd variants). That second-stage script decrypted (AES-256-CBC) an embedded JavaScript payload -- the TonRAT implant -- and downloaded a legitimate Node.js v24.13.0 runtime directly from nodejs.org to execute it from a user-writable path (AppData\Local\Nodejs), avoiding the need for a compiled malicious binary.

TonRAT's most distinctive feature is its use of the TON (The Open Network) blockchain as a dead-drop resolver: the implant queries the public tonapi.io API for a smart-contract-stored value to obtain its current WebSocket command-and-control domain at runtime, letting the operators rotate infrastructure (observed moving from zloapobikahy23[.]bond to tonajukbhuakpo2[.]shop in early June 2026) without needing to recompile or re-deliver the malware. The WebSocket channel (wss://tonajukbhuakpo2[.]shop/w) is further encrypted using ECDH (secp256k1) key exchange and AES-256-CBC, with a custom Base64 alphabet layered on top. Observed RAT capabilities include system-information exfiltration (hostname, username, OS, CPU, MAC, architecture, memory), arbitrary remote command execution with result exfiltration, and follow-on browser-credential and LSASS-adjacent credential access. For defense evasion, the malware hides its PowerShell console window via the ShowWindow Windows API, adds a Windows Defender path exclusion for %temp%\*.exe via Add-MpPreference, checks for already-running node.exe processes, and packs its JavaScript with Obfuscator.io VM-based obfuscation (expanding to roughly 17,000 lines of obfuscated code). Persistence is established via the HKCU\...\CurrentVersion\Run registry key.

By June 2026 it was publicly disclosed that unauthorized access via this campaign led to modification of victim hotel bank account information, resulting in financial losses at affected Japanese hotel operators. Independent reporting from Trend Micro (tracking the implant as TrojanSpy.JS.TONRESOLVER.A / 'TONResolver') and, per Security Affairs, from Microsoft Threat Intelligence describes a broader and evolving version of the same campaign: guest-complaint and health/bedbug-inspection themed lures in additional languages (Japanese, Danish, Dutch, and others), 'authentication laundering' via Calendly/Google redirect abuse, dual Registry Run/RunOnce persistence, and fixed-IP C2 over non-standard ports (56001-56003, 8443, 8445, 8453, 5555) in addition to the TON-resolved WebSocket channel, with secondary targeting observed beyond Japan (Austria, Australia, France, Germany, Indonesia, Italy, Netherlands, Russia, South Korea, Turkey, UK, US). No specific threat actor has been publicly attributed; the campaign's financial-fraud outcome (bank account modification) points to a financially motivated actor. ITOCHU's August 2026 English-language republication notes that Booking.com-impersonation phishing activity of this kind continues to be observed in the wild.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1566 Phishing
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1564 Hide Artifacts
- T1685 Disable or Modify Tools
- T1057 Process Discovery
- T1082 System Information Discovery
- T1555 Credentials from Password Stores
- T1003 OS Credential Dumping
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1571 Non-Standard Port

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TonRAT Post-Exploitation - Node.js Staged from AppData with Defender Exclusion and Run-Key Persistence** (`TL-2026-2175-SPL-002`)

Detects the post-exploitation stage: the second-stage PowerShell script (LE3f0MRT.ps1-class) downloads a portable Node.js runtime into a user-writable AppData path to execute the decrypted TonRAT JavaScript payload, adds a Windows Defender path exclusion via Add-MpPreference, and establishes Registry Run-key persistence. Also covers the implant's follow-on browser-credential and LSASS-adjacent credential access.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1547.001, T1562.001, T1564.003, T1105, T1555.003, T1003.001
- **Data sources:** sysmon, windows_security, microsoft_defender
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" (EventCode=1 OR EventCode=11 OR EventCode=13)
| eval node_from_appdata=if(match(lower(Image), "\\appdata\\local\\nodejs\\node\.exe$") OR (match(lower(TargetFilename), "\\appdata\\local\\nodejs\\") AND match(lower(TargetFilename), "node\.exe$|\.js$")), 1, 0)
| eval defender_exclusion=if(EventCode=1 AND match(CommandLine, "(?i)Add-MpPreference.*-ExclusionPath.*\\temp\\.*\*\.exe"), 1, 0)
| eval runkey_persist=if(EventCode=13 AND match(lower(TargetObject), "\\currentversion\\run\\") AND match(lower(Details), "nodejs|\.js"), 1, 0)
| where node_from_appdata=1 OR defender_exclusion=1 OR runkey_persist=1
| stats count values(EventCode) as event_codes values(CommandLine) as commands by _time, ComputerName, user, Image, TargetFilename, TargetObject
| sort -_time
```

### Microsoft KQL

```kql
let susp_paths = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FolderPath has @"\AppData\Local\Nodejs\" and FileName =~ "node.exe"
| project Timestamp, DeviceName, AccountName, FolderPath, ProcessCommandLine, InitiatingProcessFileName;
let defender_exclusion = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has "Add-MpPreference" and ProcessCommandLine has "ExclusionPath" and ProcessCommandLine has_any ("\\temp\\", "%temp%")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine;
let run_key = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where RegistryKey has @"CurrentVersion\Run" and (RegistryValueData has "Nodejs" or RegistryValueData has ".js")
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName, RegistryKey, RegistryValueData;
susp_paths | union defender_exclusion | union run_key
| order by Timestamp desc
```

### Sigma

```yaml
title: TonRAT Post-Exploitation - Portable Node.js Execution with Defender Exclusion and Run-Key Persistence
id: 9b3f7d21-4a6e-4c58-8f12-3e9a7b5d1c46
status: experimental
description: Detects a legitimate Node.js runtime executed from a user-writable AppData path alongside a Windows Defender exclusion added via Add-MpPreference and/or a Registry Run-key referencing the Nodejs staging directory, consistent with TonRAT/TONResolver post-exploitation.
references:
  - https://blog-en.itochuci.co.jp/entry/2026/08/28/130100
  - https://www.trendmicro.com/en_us/research/26/f/tonresolver.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-08-28
tags:
  - attack.persistence
  - attack.t1547.001
  - attack.defense-evasion
  - attack.t1562.001
  - attack.t1564.003
  - attack.command-and-control
  - attack.t1105
  - attack.tool.tonrat
logsource:
  category: process_creation
  product: windows
detection:
  selection_node:
    Image|contains: '\AppData\Local\Nodejs\'
    Image|endswith: '\node.exe'
  selection_exclusion:
    CommandLine|contains|all:
      - 'Add-MpPreference'
      - 'ExclusionPath'
  condition: selection_node or selection_exclusion
falsepositives:
  - Developers legitimately running a portable Node.js install from AppData (verify absence of the Defender-exclusion + Run-key combination)
level: high
```

**Known false positives:**

- Software developers running portable/self-hosted Node.js installs from AppData for legitimate build tooling (rare in a hotel-operator staff population; correlate with the Defender-exclusion and Run-key indicators to reduce noise)

**Tuning notes:** In environments with legitimate developer use of portable Node.js, require co-occurrence of at least two of the three sub-signals (node-from-AppData, Add-MpPreference exclusion, Run-key write) within a 10-minute window before alerting at high severity; alone, the node-from-AppData signal should page at medium.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Booking.com Impersonation Phishing - Calendly/SendGrid Authentication Laundering Delivery (locked: unlock with TL Creds)
- TonRAT JavaScript Payload Decryption Chain - Obfuscated PowerShell to AES-Decrypted Node.js Execution (locked: unlock with TL Creds)
- TonRAT C2 - Non-Standard Port Beaconing and DNS Queries for Rotating .cfd/.bond/.shop Infrastructure (locked: unlock with TL Creds)
- Sigma: Malicious ZIP-Delivered LNK Masquerading as Photo Opens PowerShell Downloader (locked: unlock with TL Creds)
- Sigma: TonRAT Defense-Evasion Bundle - Hidden PowerShell Window Plus Registry Run-Key Write (locked: unlock with TL Creds)
- Sigma: Outbound Query to tonapi.io Blockchain Dead-Drop Resolver Followed by WebSocket Handshake (locked: unlock with TL Creds)
- TonRAT Campaign - Double-Extension .lnk Lure Execution via Calendly/Google-Redirect Phishing (locked: unlock with TL Creds)
- TonRAT C2 - TON Blockchain Dead-Drop Resolution and Encrypted WebSocket Callback (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 21)

Defanged, TLP:CLEAR.

- IP address: `149.72.248[.]16`
- Domain: `photo-21454[.]cfd`
- URL: `hxxps://tonapi[.]io/v2/blockchain/accounts/{account_id}/methods/get_domain`

Full set of 21 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Analysis of Suspicious Emails Targeting the Hotel Industry (Part 1: Campaign Overview)](https://blog-en.itochuci.co.jp/entry/2026/08/28/130000)
- [Analysis of Suspicious Emails Targeting the Hotel Industry (Part 2: Technical Analysis)](https://blog-en.itochuci.co.jp/entry/2026/08/28/130100)
- [ホテル業界を標的とした不審メールの分析（パート1: キャンペーン概要編）](https://blog.itochuci.co.jp/entry/2026/06/11/110000)
- [ホテル業界を標的とした不審メールの分析（パート2: 技術詳細編）](https://blog.itochuci.co.jp/entry/2026/06/11/111500)
- [TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry](https://www.trendmicro.com/en_us/research/26/f/tonresolver.html)
- [Hackers Leverage Blockchain to Hit Japan's Hotels Through Booking.com](https://www.infosecurity-magazine.com/news/hackers-blockchain-japan-hotels/)
- [Analysis of Suspicious Emails Targeting the Hotel Industry](https://socprime.com/active-threats/analysis-of-suspicious-emails-targeting-the-hotel-industry/)
- [Booking website Hotel Phishing Delivers TonRAT via Node.js](https://socprime.com/active-threats/technical-analysis-of-suspicious-emails-targeting-the-hotel-industry/)
- [Hospitality Sector Hit by Phishing Campaign Using Fake Guest Complaint Emails](https://securityaffairs.com/194349/uncategorized/hospitality-sector-hit-by-phishing-campaign-using-fake-guest-complaint-emails.html)
- [Japan Hotel Industry Targeted With TONResolver RAT and Guest Complaint Phishing Emails](https://gbhackers.com/japan-hotel-industry-targeted/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2175