# TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry

> A phishing campaign observed May-June 2026 targets Japanese accommodation facilities via impersonated Booking.com guest-complaint messages, delivering a JavaScript-based RAT (TrojanSpy.JS.TONRESOLVER.A) that queries a TON blockchain smart contract as a dead-drop resolver for its command-and-control domain, giving operators rapid, take-down-resistant C2 infrastructure rotation.

- **Published:** 2026-09-02T00:00:00Z
- **Last reviewed:** 2026-09-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2295
- **ID:** TL-2026-2295
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

TrojanSpy.JS.TONRESOLVER.A ("TONResolver") is a Node.js-hosted, JavaScript-based Remote Access Trojan first documented by TrendAI (Trend Micro's research unit) on 2026-06-29, targeting employees at Japanese hotels and accommodation businesses that partner with Booking.com. Victims receive phishing emails - sent both as bulk campaigns abusing a legitimate scheduling tool's notification feature and as interactive, trust-building Gmail conversations - with guest-complaint or review-request pretexts (e.g. "重要：ゲスト滞在レビュー依頼" / "Important: Guest Stay Review Request", "【重要】お客様からの重大な苦情に関するご連絡", and "Urgent: Bed bug complaint from guest"). The lure hyperlink ("Download Photos and Videos", "証拠写真・動画を確認する") downloads a ZIP archive containing an LNK file masquerading as a photo/evidence image. Executing the LNK launches a PowerShell stager (Trojan.PS1.TONRESOLVER.A) that reconstructs its next-stage domain using System.Numerics.BigInteger arithmetic and fetches a second PS1 script from that domain, gated by a User-Agent check requiring the literal substring "Powershell". That script downloads and unpacks a portable Node.js v24.13.0 runtime and drops the VM-obfuscated JavaScript RAT (TrojanSpy.JS.TONRESOLVER.A), which establishes persistence via an HKCU Run-key autostart entry and uses a mutex to prevent duplicate execution.

TONResolver's defining characteristic is its command-and-control resolution mechanism: rather than hardcoding a C2 domain, the JavaScript payload queries a TON (The Open Network) blockchain smart contract at address 0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9 via the public tonapi.io REST API (GET /v2/blockchain/accounts/{contract}/methods/get_domain) to resolve its live C2 domain - a Web Service: Dead Drop Resolver implementation using a permissionless public blockchain instead of a conventional paste site or social-media profile. The contract's on-chain method is gated by op-code 0x17BE49CF and a CRC16/XMODEM-derived selector (integer 119378 for "get_domain"), and only accepts domain updates authenticated against a stored management wallet (0:6d5b44d0678e6bd6703f2cabd2531ccf5a0b11cc081f8f7175bd679db4c12d41). Because updating the resolved domain is simply a blockchain transaction, the operator can rotate C2 infrastructure at will even after a domain is sinkholed or seized, with no code change required on infected endpoints. On-chain transaction history shows the contract funded with 5.984 TON on 2026-02-07 and reflects at least four C2 domain rotations between 2026-02-07 and 2026-06-02 (amanohuguta.cfd -> hsaertyuoang34.sbs -> zloapobikahy23.bond -> tonajukbhuakpo2.shop), each hosted behind Cloudflare and clustered across .cfd/.sbs/.bond/.shop TLDs; the fronting Cloudflare nameserver pair also changed (from "galilea"/"moura" to "brianna"/"roan") coincident with the June rotation.

Once connected, the malware negotiates a per-session key via ECDH (secp256k1) plus HKDF-SHA256, then encrypts further traffic with AES-256-CBC over a WebSocket (wss://) channel to the resolved domain, sending a keepalive ping every 20 seconds with automatic reconnection on disconnect. A typed message protocol (type:0 keepalive-ping / type:1 keepalive-response / type:2 client-pubkey / type:3 server-pubkey+salt / type:4 endpoint-info / type:5 arbitrary-JS-execution / type:6 command-result / type:7 file-retrieval-execution / type:8 PowerShell-execution) gives the operator a full interactive backdoor: arbitrary JavaScript and PowerShell execution, file retrieval, and endpoint fingerprinting (username, hostname, OS, CPU core count, memory, MAC address, source domain, sent as a type:4 message). Observed post-compromise behavior includes access to Chrome and Edge browser profile directories under each user's AppData\Local (stored credentials/cookies) and process interaction with lsass.exe, consistent with browser credential-store theft and LSASS-memory credential access feeding further account takeover against Booking.com partner-portal and hotel PMS credentials.

Distribution infrastructure is large and disposable: dozens of photo-themed .cfd/.xyz domains (photo-<digits>.cfd, photo-dekor.xyz, etc.) host the initial ZIP/LNK payloads, a cluster of randomized-string .com domains and guest/photo-book-themed .pro domains support the delivery and PS1-staging tiers, and the .com registrant used a disposable-email-domain alias ("ghastlier"). While confirmed victims are Japanese Booking.com-partner accommodation businesses, Trend Micro's global telemetry also recorded secondary exposure to the phishing/distribution infrastructure in Austria, Australia, France, Germany, Indonesia, Italy, the Netherlands, Russia, South Korea, Turkey, the UK, and the US. As of the 2026-06-29 report, the campaign remained active, with the operator continuing to register new domains and rotate C2 infrastructure in apparent response to detection and takedown pressure.

## MITRE ATT&CK

- T1566.002 Phishing: Spearphishing Link
- T1204.002 User Execution: Malicious File
- T1036.008 Masquerading: Masquerade File Type
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1027 Obfuscated Files or Information
- T1547.001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
- T1102.001 Web Service: Dead Drop Resolver
- T1573.001 Encrypted Channel: Symmetric Cryptography
- T1573.002 Encrypted Channel: Asymmetric Cryptography
- T1071.001 Application Layer Protocol: Web Protocols
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1003.001 OS Credential Dumping: LSASS Memory
- T1005 Data from Local System

## Sources

- [TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry](https://www.trendmicro.com/en_us/research/26/f/tonresolver.html)
- [IOCs_TONResolver.txt](https://www.trendmicro.com/content/dam/trendmicro/global/en/research/26/f/tonresolver/IOCs_TONResolver.txt)
- [Hackers Leverage Blockchain to Hit Japan's Hotels Through Booking.com](https://www.infosecurity-magazine.com/news/hackers-blockchain-japan-hotels/)
- [Japan Hotel Industry Targeted With TONResolver RAT and Guest-Complaint Phishing](https://gbhackers.com/japan-hotel-industry-targeted/)
- [TONResolver RAT - Malware removal instructions](https://www.pcrisk.com/removal-guides/35654-tonresolver-rat)
- [Booking.com: Trojaner nutzt TON-Blockchain für Angriffe](https://borncity.com/news/booking-com-trojaner-nutzt-ton-blockchain-fuer-angriffe/)
- [TONResolver: Neue Malware nutzt Blockchain als Angriffs-Infrastruktur](https://www.boerse-express.com/news/articles/tonresolver-neue-malware-nutzt-blockchain-als-angriffs-infrastruktur-923056)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2295