Loading malware…
TONResolver is a JavaScript-based Windows remote access trojan used as an initial-access and persistence foothold in phishing campaigns targeting the hospitality sector, particularly Booking.com partner accommodations in Japan. It has been delivered through guest-complaint and review-request lures that direct victims to download ZIP archives containing a disguised Windows shortcut, which launches PowerShell to install a bundled Node.js execution environment and run the malware.
The malware is notable for abusing The Open Network (TON) blockchain as a dead-drop resolver for command-and-control discovery. Rather than relying on a fixed server address, TONResolver queries TON-related infrastructure to obtain its current command-and-control destination from a smart contract, allowing operators to rotate infrastructure without modifying the implant and complicating disruption efforts. Communications with the resolved server are maintained over encrypted WebSocket channels, and observed cryptographic mechanisms include elliptic-curve key exchange and AES-based session protection.
TONResolver uses virtual machine-based obfuscation and encrypted components to hinder static analysis. On execution, it performs duplicate-instance checks using process logic and a mutex, verifies network connectivity, fingerprints the host, and establishes persistence through a per-user Windows autorun mechanism. Observed host profiling includes collection of system and user context such as username, hostname, operating system details, processor count, memory information, and MAC address. The implant maintains periodic keepalive traffic and can reconnect after interruptions.
Observed operator capabilities include arbitrary JavaScript execution, PowerShell command execution, and retrieval and execution of additional payloads, making TONResolver a flexible post-compromise backdoor. Follow-on activity associated with infections has indicated likely credential theft, including access to browser-stored data from Chrome and Edge and interaction consistent with attempts to obtain sensitive credentials from the local system. The malware has been associated with campaigns focused on long-term access and subsequent compromise rather than immediate disruptive effects.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files.
The script then executes Invoke-WebRequest against the reconstructed domain, saves the retrieved PS1 file under "%TEMP%", and executes it with PowerShell.
The PowerShell command embedded in the LNK file handles two large integers... reconstructing the destination domain. The script then executes Invoke-WebRequest against the reconstructed domain, saves the retrieved PS1 file under "%TEMP%", and executes it with PowerShell.
The JavaScript file executed with arguments by node.exe (detection name: TrojanSpy.JS.TONRESOLVER.A) was identified as malware functioning as a remote access trojan (RAT).
This RAT malware employs VM-based obfuscation, making it impossible to reveal details through pure static analysis alone.
the infection began when the user clicked a shortcut link file (LNK) disguised as a photo file within the zip archive.
Starting from the node.exe process loaded with TONResolver, an executable was deployed... and further execution was found to have attempted credential theft.
the attacker packaged the malware as a Node.js application and applied virtual machine-based obfuscation, a method that wraps the code inside a protected execution environment, preventing security researchers from easily inspecting its logic through static analysis alone.
Transmission of endpoint information... includes the endpoint's username, hostname, as well as OS, CPU core count, memory information, and MAC address hardware information.
The deployed executable was observed performing operations on the following folders... C:\Users\<UserName>\AppData\Local\Google\Chrome\User Data\ ... Microsoft\Edge\User Data\
the attacker packaged the malware as a Node.js application and applied virtual machine-based obfuscation, a method that wraps the code inside a protected execution environment, preventing security researchers from easily inspecting its logic through static analysis alone.
Connection to C&C domain via WebSocket communication... Keepalive every 20 seconds... Command reception from C&C server
dead drop resolver (DDR) is any mechanism where malware fetches its command and control (C2) address at runtime from a third-party, cyberattacker-controlled location instead of hardcoding it. | The loader posts JSON-RPC to the same high-reputation crypto SaaS hosts that wallets and decentralized applications use (Infura, Cloudflare, Binance, publicnode), so host-only network signatures drown in false positives.
the malware abuses The Open Network (TON) blockchain platform as a dead drop resolver... By storing the C&C server domain in a TON smart contract, attackers can swap in a new server at any time
If Node.exe does not exist, “node-v24.13.0-win-x64.zip” is retrieved from the official Node.js website... The Base64 string... is decrypted... to generate the JavaScript payload.
143 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware/tooling that uses TON blockchain DNS smart-contract get_domain calls as a dead drop resolver to obtain a C2 domain, with operators able to rotate the value over time.
A JavaScript-based remote access trojan used in phishing attacks against Japan’s hospitality sector. It uses the TON blockchain as a dead drop resolver by querying a TON smart contract to obtain its current C2 domain, enabling operators to rotate infrastructure without modifying the malware. It gathers host information, maintains persistent connectivity, steals browser-stored credentials and data, deploys via PowerShell and Node.js, and persists via a Windows Run registry key.
A blockchain-enabled malware implant used in phishing campaigns targeting Booking.com partner accommodations, primarily in Japan. It abuses The Open Network (TON) blockchain as a dead drop resolver to dynamically obtain C2 infrastructure, establishes persistent keepalive/backdoor access, enables command execution, and appears to support selective follow-on compromise including potential credential theft through additional payload deployment.
Malware used in phishing campaigns targeting Booking.com partner hotels in Japan. It provides initial access, supports command execution, enables credential theft, and uses TON smart contracts to rotate or replace blocked command-and-control domains dynamically.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.