---
title: "TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry"
url: https://daily.dev/posts/tonresolver-rat-abuses-ton-blockchain-to-target-japan-s-hotel-industry-n2h0vxftx
source_url: https://www.trendmicro.com/en_us/research/26/f/tonresolver.html
type: article
source: "Trend Micro"
published: 2026-06-29T20:36:10.505Z
updated: 2026-06-29T20:36:35.990Z
tags: ["malware", "blockchain", "phishing"]
reading_time: 22
upvotes: 0
comments: 0
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry

**[Trend Micro](https://daily.dev/sources/trendmicro)** · 22 min read · 0 upvotes · 0 comments

## Summary

A new malware campaign dubbed TONResolver targets Japanese hotel staff who are Booking.com partners via phishing emails impersonating guest complaints. The attack chain begins with a malicious LNK file inside a ZIP archive, which executes PowerShell to download a Node.js-based JavaScript RAT. The malware's key innovation is using the TON (The Open Network) blockchain as a dead drop resolver: the C&C server domain is stored in a TON smart contract and can be swapped at any time, making takedowns ineffective. The RAT uses VM-based obfuscation, ECDH key exchange, and AES-256-CBC encryption over WebSocket for C&C communication. Once installed, it maintains a Keepalive loop awaiting commands, with observed follow-on activity including credential theft from Chrome and Edge browser data. Two delivery methods were observed: bulk phishing and conversational Gmail-based attacks that build trust before delivering a malicious URL. Mitigations include blocking access to tonapi.io, restricting PowerShell external communications, and monitoring for anomalous Node.js usage.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.trendmicro.com/en_us/research/26/f/tonresolver.html>

## Similar posts on daily.dev

- [Phishers Gain Persistence in EU, Asia Hospitality Orgs](https://daily.dev/posts/phishers-gain-persistence-in-eu-asia-hospitality-orgs-5fcvxyugq) · Dark Reading · 0 upvotes · 0 comments
- [TrickMo Android banker adopts TON blockchain for covert comms](https://daily.dev/posts/trickmo-android-banker-adopts-ton-blockchain-for-covert-comms-hchqbvuzn) · BleepingComputer · 0 upvotes · 0 comments
- [Large-Scale ClickFix Phishing Attacks Target Hotel Systems with PureRAT Malware](https://daily.dev/posts/large-scale-clickfix-phishing-attacks-target-hotel-systems-with-purerat-malware-kc5f9td6d) · The Hacker News · 0 upvotes · 0 comments

---

Tags: [#malware](https://daily.dev/tags/malware), [#blockchain](https://daily.dev/tags/blockchain), [#phishing](https://daily.dev/tags/phishing)

[View this post on daily.dev](https://daily.dev/posts/tonresolver-rat-abuses-ton-blockchain-to-target-japan-s-hotel-industry-n2h0vxftx)