TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry

TONResolver RAT Abuses TON Blockchain to Target Japan's (TL-2026-2295), also tracked as TONResolver RAT, is a high-severity malware campaign, first published 2026-09-02. It has no confirmed attribution, maps to 16 MITRE ATT&CK techniques (T1003.001, T1005, T1027), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-2295

Threat ID
TL-2026-2295
Also known as
TONResolver RAT, TONResolver
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-09-02
Last reviewed
2026-09-02
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
hospitality, travel, accommodation, online-travel-agency-partners
Target regions
japan, austria, australia, france, germany, indonesia, italy, netherlands, russia, south korea, turkey, united kingdom
Detection rules
9
Indicators of compromise
22

Malware and tooling in TONResolver RAT Abuses TON Blockchain to Target Japan's

Malware and tooling: Trojan.PS1.TONRESOLVER.A, TrojanSpy.JS.TONRESOLVER.A

A phishing campaign observed May-June 2026 targets Japanese accommodation facilities via impersonated Booking.com guest-complaint messages, delivering a JavaScript-based RAT (TrojanSpy.JS.TONRESOLVER.A) that queries a TON blockchain smart contract as a dead-drop resolver for its command-and-control domain, giving operators rapid, take-down-resistant C2 infrastructure rotation.

How TONResolver RAT Abuses TON Blockchain to Target Japan's works

TrojanSpy.JS.TONRESOLVER.A ("TONResolver") is a Node.js-hosted, JavaScript-based Remote Access Trojan first documented by TrendAI (Trend Micro's research unit) on 2026-06-29, targeting employees at Japanese hotels and accommodation businesses that partner with Booking.com. Victims receive phishing emails - sent both as bulk campaigns abusing a legitimate scheduling tool's notification feature and as interactive, trust-building Gmail conversations - with guest-complaint or review-request pretexts (e.g. "重要：ゲスト滞在レビュー依頼" / "Important: Guest Stay Review Request", "【重要】お客様からの重大な苦情に関するご連絡", and "Urgent: Bed bug complaint from guest"). The lure hyperlink ("Download Photos and Videos", "証拠写真・動画を確認する") downloads a ZIP archive containing an LNK file masquerading as a photo/evidence image. Executing the LNK launches a PowerShell stager (Trojan.PS1.TONRESOLVER.A) that reconstructs its next-stage domain using System.Numerics.BigInteger arithmetic and fetches a second PS1 script from that domain, gated by a User-Agent check requiring the literal substring "Powershell". That script downloads and unpacks a portable Node.js v24.13.0 runtime and drops the VM-obfuscated JavaScript RAT (TrojanSpy.JS.TONRESOLVER.A), which establishes persistence via an HKCU Run-key autostart entry and uses a mutex to prevent duplicate execution.

TONResolver's defining characteristic is its command-and-control resolution mechanism: rather than hardcoding a C2 domain, the JavaScript payload queries a TON (The Open Network) blockchain smart contract at address 0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9 via the public tonapi.io REST API (GET /v2/blockchain/accounts/{contract}/methods/get_domain) to resolve its live C2 domain - a Web Service: Dead Drop Resolver implementation using a permissionless public blockchain instead of a conventional paste site or social-media profile. The contract's on-chain method is gated by op-code 0x17BE49CF and a CRC16/XMODEM-derived selector (integer 119378 for "get_domain"), and only accepts domain updates authenticated against a stored management wallet (0:6d5b44d0678e6bd6703f2cabd2531ccf5a0b11cc081f8f7175bd679db4c12d41). Because updating the resolved domain is simply a blockchain transaction, the operator can rotate C2 infrastructure at will even after a domain is sinkholed or seized, with no code change required on infected endpoints. On-chain transaction history shows the contract funded with 5.984 TON on 2026-02-07 and reflects at least four C2 domain rotations between 2026-02-07 and 2026-06-02 (amanohuguta.cfd -> hsaertyuoang34.sbs -> zloapobikahy23.bond -> tonajukbhuakpo2.shop), each hosted behind Cloudflare and clustered across .cfd/.sbs/.bond/.shop TLDs; the fronting Cloudflare nameserver pair also changed (from "galilea"/"moura" to "brianna"/"roan") coincident with the June rotation.

Once connected, the malware negotiates a per-session key via ECDH (secp256k1) plus HKDF-SHA256, then encrypts further traffic with AES-256-CBC over a WebSocket (wss://) channel to the resolved domain, sending a keepalive ping every 20 seconds with automatic reconnection on disconnect. A typed message protocol (type:0 keepalive-ping / type:1 keepalive-response / type:2 client-pubkey / type:3 server-pubkey+salt / type:4 endpoint-info / type:5 arbitrary-JS-execution / type:6 command-result / type:7 file-retrieval-execution / type:8 PowerShell-execution) gives the operator a full interactive backdoor: arbitrary JavaScript and PowerShell execution, file retrieval, and endpoint fingerprinting (username, hostname, OS, CPU core count, memory, MAC address, source domain, sent as a type:4 message). Observed post-compromise behavior includes access to Chrome and Edge browser profile directories under each user's AppData\Local (stored credentials/cookies) and process interaction with lsass.exe, consistent with browser credential-store theft and LSASS-memory credential access feeding further account takeover against Booking.com partner-portal and hotel PMS credentials.

Distribution infrastructure is large and disposable: dozens of photo-themed .cfd/.xyz domains (photo-<digits>.cfd, photo-dekor.xyz, etc.) host the initial ZIP/LNK payloads, a cluster of randomized-string .com domains and guest/photo-book-themed .pro domains support the delivery and PS1-staging tiers, and the .com registrant used a disposable-email-domain alias ("ghastlier"). While confirmed victims are Japanese Booking.com-partner accommodation businesses, Trend Micro's global telemetry also recorded secondary exposure to the phishing/distribution infrastructure in Austria, Australia, France, Germany, Indonesia, Italy, the Netherlands, Russia, South Korea, Turkey, the UK, and the US. As of the 2026-06-29 report, the campaign remained active, with the operator continuing to register new domains and rotate C2 infrastructure in apparent response to detection and takedown pressure.

MITRE ATT&CK techniques used in TL-2026-2295

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory; T1555.003 Credentials from Password Stores: Credentials from Web Browsers

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036.008 Masquerading: Masquerade File Type

Discovery

T1033 System Owner/User Discovery; T1082 System Information Discovery

Execution

T1059.001 Command and Scripting Interpreter: PowerShell; T1059.007 Command and Scripting Interpreter: JavaScript; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102.001 Web Service: Dead Drop Resolver; T1573.001 Encrypted Channel: Symmetric Cryptography; T1573.002 Encrypted Channel: Asymmetric Cryptography

Persistence

T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder

Initial Access

T1566.002 Phishing: Spearphishing Link

Remediation for TONResolver RAT Abuses TON Blockchain to Target Japan's

Immediate actions

  • Block/restrict endpoint and proxy-gateway connectivity to tonapi.io and other TON blockchain API endpoints
  • Block outbound PowerShell (powershell.exe) network communications at the endpoint firewall
  • Deploy User-Agent filtering (block requests containing the literal string 'Powershell') via a Secure Web Gateway / Zero Trust Secure Access proxy
  • Quarantine and block the known distribution and C2 domain clusters (.cfd/.xyz/.com/.pro/.sbs/.bond/.shop) listed in threat_iocs

Workarounds

  • Restrict or monitor LNK file execution from downloaded/extracted archive content
  • Monitor registry writes to HKCU\Software\Microsoft\Windows\CurrentVersion\Run for unauthorized autorun entries

Longer-term hardening

  • Enforce application control (allow-listing) to block unauthorized Node.js (node.exe) execution on non-developer endpoints
  • Baseline and alert on anomalous endpoint process execution chains (powershell.exe -> node.exe with .js arguments)
  • User awareness training for hospitality/OTA-partner staff on guest-complaint and review-request phishing lures
  • Harden LSASS access (Credential Guard / LSA Protection) and browser credential-store protections on endpoints

Timeline of TONResolver RAT Abuses TON Blockchain to Target Japan's

  • First C2 domain (amanohuguta.cfd) written to the TON smart contract's get_domain method at 14:03:27 UTC.
  • TON smart contract (0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9) funded with 5.984 TON at 13:37:16 UTC, establishing the future dead-drop resolver.
  • C2 domain rotated on-chain to hsaertyuoang34.sbs at 19:17:05 UTC.
  • C2 domain rotated on-chain to zloapobikahy23.bond at 15:19:03 UTC.
  • Bulk and interactive Gmail-based phishing campaign impersonating Booking.com guest-complaint/review notifications observed targeting Japanese accommodation partner staff (reported by Trend Micro as 'late May 2026').
  • Latest observed C2 domain rotation on-chain to tonajukbhuakpo2.shop at 02:53:50 UTC.
  • Fronting Cloudflare nameserver pair for the C2/distribution domains changed from 'galilea'/'moura' to 'brianna'/'roan', coincident with the June C2 rotation.
  • TrendAI (Trend Micro) publishes 'TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry', disclosing the campaign, malware, and TON dead-drop resolver mechanism, and flags the payload High severity in Vision One.

Sources cited for TONResolver RAT Abuses TON Blockchain to Target Japan's

More in malware

Detection coverage for TL-2026-2295

As of 2026-09-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2295 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2295

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats