Latest Threats

linking threat corpus_

TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry — Threadlinqs Intelligence

As of 2026-09-02, TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.

Threat ID: TL-2026-2295 · Severity: HIGH · Status: ACTIVE · Category: MALWARE

A phishing campaign observed May-June 2026 targets Japanese accommodation facilities via impersonated Booking.com guest-complaint messages, delivering a JavaScript-based RAT

TrojanSpy.JS.TONRESOLVER.A ("TONResolver") is a Node.js-hosted, JavaScript-based Remote Access Trojan first documented by TrendAI (Trend Micro's research unit) on 2026-06-29, targeting employees at Japanese hotels and accommodation businesses that partner with Booking.com. Victims receive phishing emails - sent both as bulk campaigns abusing a legitimate scheduling tool's notification feature and as interactive, trust-building Gmail conversations - with guest-complaint or review-request pretexts (e.g. "重要：ゲスト滞在レビュー依頼" / "Important: Guest Stay Review Request", "【重要】お客様からの重大な苦情に関するご連絡", and "Urgent: Bed bug complaint from guest"). The lure hyperlink ("Download Photos and Videos", "証拠写真・動画を確認する") downloads a ZIP archive containing an LNK file masquerading as a photo/evidence image. Executing the LNK launches a PowerShell stager (Trojan.PS1.TONRESOLVER.A) that reconstructs its next-stage domain using System.Numerics.BigInteger arithmetic and fetches a second PS1 script from that domain, gated by a User-Agent check requiring the literal substring "Powershell". That script downloads and unpacks a portable Node.js v24.13.0 runtime and drops the VM-obfuscated JavaScript RAT (TrojanSpy.JS.TONRESOLVER.A), which establishes persistence via an HKCU Run-key autostart entry and uses a mutex to prevent duplicate execution. TONResolver's defining characteristic is its command-and-control resolution mechanism: rather than hardcoding a C2 domain, the JavaScript payload queries a TON (The Open Network) blockchain smart contract at address 0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9 via the public tonapi.io REST API (GET /v2/blockchain/accounts/{contract}/methods/get_domain) to resolve its live C2 domain - a Web Service: Dead Drop Resolver implementation using a permissionless public blockchain instead of a conventional paste site or social-media profile. The contract's on-chain method is gated by op-code 0x17BE49CF and a CRC16/XMODEM-derived selector (integer 119378 for "get_domain"), and only accepts domain updates authenticated against a stored management wallet (0:6d5b44d0678e6bd6703f2cabd2531ccf5a0b11cc081f8f7175bd679db4c12d41). Because updating the resolved domain is simply a blockchain transaction, the operator can rotate C2 infrastructure at will even after a domain is sinkholed or seized, with no code change required on infected endpoints. On-chain transaction history shows the contract funded with 5.984 TON on 2026-02-07 and reflects at least four C2 domain rotations between 2026-02-07 and 2026-06-02 (amanohuguta.cfd -> hsaertyuoang34.sbs -> zloapobikahy23.bond -> tonajukbhuakpo2.shop), each hosted behind Cloudflare and clustered across .cfd/.sbs/.bond/.shop TLDs; the fronting Cloudflare nameserver pair also changed (from "galilea"/"moura" to "brianna"/"roan") coincident with the June rotation. Once connected, the malware negotiates a per-session key via ECDH (secp256k1) plus HKDF-SHA256, then encrypts further traffic with AES-256-CBC over a WebSocket (wss://) channel to the resolved domain, sending a keepalive ping every 20 seconds with automatic reconnection on disconnect. A typed message protocol (type:0 keepalive-ping / type:1 keepalive-response / type:2 client-pubkey / type:3 server-pubkey+salt / type:4 endpoint-info / type:5 arbitrary-JS-execution / type:6 command-result / type:7 file-retrieval-execution / type:8 PowerShell-execution) gives the operator a full interactive backdoor: arbitrary JavaScript and PowerShell execution, file retrieval, and endpoint fingerprinting (username, hostname, OS, CPU core count, memory, MAC address, source domain, sent as a type:4 message). Observed post-compromise behavior includes access to Chrome and Edge browser profile directories under each user's AppData\Local (stored credentials/cookies) and process interaction with lsass.exe, consistent with browser credential-store theft and LSASS-memory credential access feeding further account takeover against Booking.com partne

MITRE ATT&CK Techniques

T1566.002 Phishing: Spearphishing Link; T1204.002 User Execution: Malicious File; T1036.008 Masquerading: Masquerade File Type; T1059.001 Command and Scripting Interpreter: PowerShell; T1059.007 Command and Scripting Interpreter: JavaScript; T1027 Obfuscated Files or Information; T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder; T1102.001 Web Service: Dead Drop Resolver; T1573.001 Encrypted Channel: Symmetric Cryptography; T1573.002 Encrypted Channel: Asymmetric Cryptography; T1071.001 Application Layer Protocol: Web Protocols; T1082 System Information Discovery; T1033 System Owner/User Discovery; T1555.003 Credentials from Password Stores: Credentials from Web Browsers; T1003.001 OS Credential Dumping: LSASS Memory; T1005 Data from Local System

Target sectors: hospitality, travel, accommodation, online-travel-agency-partners

Target regions: japan, austria, australia, france, germany, indonesia, italy, netherlands, russia, south korea, turkey, united kingdom

Timeline

2026-02-07 TON smart contract (0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9) funded with 5.984 TON at 13:37:16 UTC, establishing the future dead-drop resolver.
2026-02-07 First C2 domain (amanohuguta.cfd) written to the TON smart contract's get_domain method at 14:03:27 UTC.
2026-02-09 C2 domain rotated on-chain to hsaertyuoang34.sbs at 19:17:05 UTC.
2026-02-20 C2 domain rotated on-chain to zloapobikahy23.bond at 15:19:03 UTC.
2026-05-25 Bulk and interactive Gmail-based phishing campaign impersonating Booking.com guest-complaint/review notifications observed targeting Japanese accommodation partner staff (reported by Trend Micro as 'late May 2026').
2026-06-02 Latest observed C2 domain rotation on-chain to tonajukbhuakpo2.shop at 02:53:50 UTC.
2026-06-15 Fronting Cloudflare nameserver pair for the C2/distribution domains changed from 'galilea'/'moura' to 'brianna'/'roan', coincident with the June C2 rotation.
2026-06-29 TrendAI (Trend Micro) publishes 'TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry', disclosing the campaign, malware, and TON dead-drop resolver mechanism, and flags the payload High severity in Vision One.

References

Detections & IOCs

As of 2026-09-03, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.

Community OSINT corroboration

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

MALWARE, HIGH, threat intelligence, cybersecurity, T1566.002, T1204.002, T1036.008, T1059.001, T1059.007, T1027, T1547.001, T1102.001, T1573.001, T1573.002

Threadlinqs Intelligence — Real-Time Threat Detection Platform

Latest Threats

🔄 Threat Comparison