Loading malware…
TONResolver is a JavaScript-based remote access trojan targeting Windows systems and executed through Node.js. It has been deployed in phishing campaigns against hotels and accommodation businesses, including Booking.com partners, with prominent targeting of Japan. Lures impersonate guest complaints, review requests, accommodation inquiries, and legal threats. Both bulk emails and trust-building conversations deliver links to ZIP archives containing malicious Windows shortcuts disguised as photographs. Opening a shortcut launches PowerShell, which downloads a legitimate Node.js runtime and installs the implant.
TONResolver uses The Open Network (TON) blockchain as a dead drop resolver for command-and-control discovery. It queries a public TON API to invoke a smart contract's get_domain method and retrieve the current external C2 domain. Operators can update the contract to redirect existing infections without modifying or redistributing the malware, making infrastructure rotation resilient to conventional domain and hosting takedowns. The blockchain stores the C2 pointer rather than serving as the channel for all operator commands.
The implant employs custom virtual-machine-based obfuscation, checks for duplicate execution, and establishes persistence through a Windows user Run key. It collects endpoint details, including the username, hostname, operating system, processor count, memory information, and MAC address. C2 communications use WebSockets protected by ECDH over secp256k1, HKDF-SHA256, and AES-256-CBC. TONResolver maintains periodic keepalive messages and reconnects after network interruptions. Supported commands include arbitrary JavaScript execution, PowerShell execution, and retrieval and execution of additional files. It serves as an initial-access foothold for subsequent compromise; observed follow-on activity included additional payload deployment and behavior consistent with credential theft involving Chrome, Edge, and the Windows security authority process.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files.
The script then executes Invoke-WebRequest against the reconstructed domain, saves the retrieved PS1 file under "%TEMP%", and executes it with PowerShell.
The PowerShell command embedded in the LNK file handles two large integers... reconstructing the destination domain. The script then executes Invoke-WebRequest against the reconstructed domain, saves the retrieved PS1 file under "%TEMP%", and executes it with PowerShell.
The JavaScript file executed with arguments by node.exe (detection name: TrojanSpy.JS.TONRESOLVER.A) was identified as malware functioning as a remote access trojan (RAT).
This RAT malware employs VM-based obfuscation, making it impossible to reveal details through pure static analysis alone.
the infection began when the user clicked a shortcut link file (LNK) disguised as a photo file within the zip archive.
Starting from the node.exe process loaded with TONResolver, an executable was deployed... and further execution was found to have attempted credential theft.
the attacker packaged the malware as a Node.js application and applied virtual machine-based obfuscation, a method that wraps the code inside a protected execution environment, preventing security researchers from easily inspecting its logic through static analysis alone.
Transmission of endpoint information... includes the endpoint's username, hostname, as well as OS, CPU core count, memory information, and MAC address hardware information.
The deployed executable was observed performing operations on the following folders... C:\Users\<UserName>\AppData\Local\Google\Chrome\User Data\ ... Microsoft\Edge\User Data\
the attacker packaged the malware as a Node.js application and applied virtual machine-based obfuscation, a method that wraps the code inside a protected execution environment, preventing security researchers from easily inspecting its logic through static analysis alone.
Connection to C&C domain via WebSocket communication... Keepalive every 20 seconds... Command reception from C&C server
dead drop resolver (DDR) is any mechanism where malware fetches its command and control (C2) address at runtime from a third-party, cyberattacker-controlled location instead of hardcoding it. | The loader posts JSON-RPC to the same high-reputation crypto SaaS hosts that wallets and decentralized applications use (Infura, Cloudflare, Binance, publicnode), so host-only network signatures drown in false positives.
The use of a blockchain to resolve C2 infrastructure, also known as blockchain-based dead drop resolving, is a novel technique to create more persistent ways of providing updated C2s to infected hosts.
If Node.exe does not exist, “node-v24.13.0-win-x64.zip” is retrieved from the official Node.js website... The Base64 string... is decrypted... to generate the JavaScript payload.
144 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
NodeJS-based malware delivered through malicious LNK shortcuts in archives linked from fabricated guest complaints and related hospitality lures. It obtains its current command-and-control address from the TON blockchain, enabling infrastructure rotation without updating deployed malware and complicating conventional domain and IP takedowns.
Delivered through hotel complaint-themed phishing emails and malicious Windows shortcuts disguised as images. It runs using Node.js and retrieves its external C2 address through a public TON blockchain API using wallet or smart-contract data. The blockchain supplies directions to the command server rather than issuing commands itself. Operators can update these directions to help infections survive C2 infrastructure takedowns.
Delivered through malicious LNK shortcuts in archives linked from fabricated guest complaints, reviews, or inquiries. Runs through NodeJS and queries a public TON API to retrieve an encoded C2 address stored in wallet or smart-contract data. Blockchain transactions allow operators to rotate C2 infrastructure while infected hosts continue consulting the same on-chain address. Similarities to EtherRAT suggest possible shared loader infrastructure, but the report does not establish common operators.
Malware/tooling that uses TON blockchain DNS smart-contract get_domain calls as a dead drop resolver to obtain a C2 domain, with operators able to rotate the value over time.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.