Hackers are targeting hotels with fake guest complaints and negative reviews that lead staff to malware disguised as photographic evidence. The campaign delivers EtherRAT or TONResolver, two malware …

Hackers are targeting hotels with fake guest complaints and negative reviews that lead staff to malware disguised as photographic evidence. The campaign delivers EtherRAT or TONResolver, two malware families that use public blockchains to find their command and control servers instead of relying on a fixed address inside the malware. The emails reach front desk, reservations, and guest relations teams, where handling customer concerns is part of daily work. Messages describe dirty rooms, disputes with employees, or possible legal action. Links offer supposed photos, videos, or documents, turning pressure to protect a hotel’s reputation into a reason to open dangerous files. Researchers from Cofense identified EtherRAT and TONResolver in these campaigns and detailed their findings in an October 7 report by intelligence analyst Kahng An. They assess with moderate confidence that the activity continues earlier Booking.com phishing campaigns, although shared malware tools used by separate groups could also explain the similarities. Hackers Use Negative Hotel Reviews Earlier attacks used fake booking messages and ClickFix pages that asked staff to paste commands into the Windows Run window. Those campaigns commonly delivered PureRAT or NetSupport Manager. Previous reporting on compromised hotel booking accounts shows how hotel infections can support wider fraud, but Cofense does not confirm that outcome here. A sample Booking.com-spoofing email (Source – Cofense) The newer emails link to an archive containing a malicious Windows shortcut, or LNK file, disguised as a JPG image. Opening it runs code rather than showing a photograph. The archive also includes a dummy MP4 file whose size changes with each download, likely producing different hashes that weaken fixed file signature checks. The shortcut downloads Node.js, a legitimate environment for running JavaScript, and installs either malware family. Both use this runtime. Cofense says this shared approach suggests a possible common loader, not proof of one operator. Researchers also assess with moderate confidence that attackers use generative AI to vary the wording of their emails. How EtherRAT and TONResolver Find C2 Servers EtherRAT reads an Ethereum smart contract through a public JSON-RPC service, using a request such as eth_call . It decodes the returned hexadecimal data and removes light masking to recover the current C2 domain or IP address. Earlier coverage of EtherRAT blockchain hiding techniques explains this same design in other attacks, without establishing who runs this hotel campaign. TONResolver follows the same basic process using a public TON blockchain API and data tied to a wallet or smart contract. Reporting on TONResolver smart contract abuse previously described hotel phishing with similar delivery methods. The key distinction is which blockchain supplies the address, not whether the malware still needs an external command server. A recent email that delivers TONResolver (Source – Cofense) This approach is called blockchain dead drop resolving. The blockchain stores directions to C2 infrastructure; it is not itself the server issuing every command. Operators can publish a new destination through a transaction, allowing existing infections to locate replacement servers without receiving a new malware file. That weakens takedowns aimed only at domains or hosting accounts. Removing a server does not erase the blockchain record that points infected devices toward its replacement. Public blockchain API requests can also resemble legitimate wallet traffic. Cofense notes that blocking Ethereum access alone may leave TON access available in campaigns using the other family. Hotel teams should examine unexpected complaint links with the same care as other unsolicited messages, even when a sender threatens immediate consequences. Cofense recommends training staff to spot malicious emails rather than relying only on fixed wording or hashes. The report also warns that public customer support, sales, and business development inboxes face similar risks. Security teams should also investigate unexpected Node.js activity on hotel workstations and link endpoint findings with email evidence. A legitimate runtime or blockchain service should not make a suspicious download appear safe to staff automatically. Indicators of compromise (IoCs):- Malware Indicator type Source value EtherRAT Ethereum contract 0x277852e1C349b03c79E348018a8391bD21C412E8 EtherRAT C2 URL hxxps[://]gateway001kir[.]com EtherRAT C2 URL hxxps[://]sslgateway001[.]com EtherRAT C2 URL hxxps[://]waygatterol002[.]com EtherRAT C2 URL hxxps[://]lotus-vista-additions-joshua[.]trycloudflare[.]com EtherRAT C2 URL hxxps[://]perrine90-deltajohnsons[.]com EtherRAT C2 URL hxxps[://]kadmecnp-643laolmd[.]com EtherRAT C2 URL hxxps[://]lermontov-656idlop[.]com EtherRAT C2 URL hxxps[://]dns1[.]southafricanorth[.]cloudapp[.]azure[.]com EtherRAT C2 domain fdffofofofo4[.]com EtherRAT C2 URL hxxps[://]update[.]norwayeast[.]cloudapp[.]azure[.]com EtherRAT C2 URL hxxps[://]allres[.]southafricanorth[.]cloudapp[.]azure[.]com EtherRAT C2 URL hxxps[://]synctimes[.]australiaeast[.]cloudapp[.]azure[.]com EtherRAT C2 URL hxxps[://]opencode-setup-al[.]com EtherRAT C2 URL hxxps[://]luxmaxing[.]southafricanorth[.]cloudapp[.]azure[.]com TONResolver TON contract 0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9 TONResolver C2 domain amanohuguta[.]cfd TONResolver C2 domain hsaertyuoang34[.]sbs TONResolver C2 domain zloapobikahy23[.]bond TONResolver C2 domain tonajukbhuakpo2[.]shop TONResolver C2 domain njzlopghznkamkl[.]cfd TONResolver C2 domain nuypoiaklber[.]lol Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC The post Hackers Use Negative Hotel Reviews to Spread Malware That Hides C2 on Blockchain appeared first on Cyber Security News .

ハッカーが、偽の宿泊客クレームや否定的なレビューを使ってホテルを標的にし、「EtherRAT」と「TONResolver」という2種類のマルウェアを配布しています。いずれも公開ブロックチェーンを悪用して、コマンド＆コントロール（C2）インフラの所在を突き止める点が特徴です。Cybersecurityadvisory

このメールは、EtherRATまたはTONResolverというマルウェアを送り付けます。いずれも公開ブロックチェーンを利用して、コマンド&コントロール（C2）サーバーの所在を突き止める仕組みを持つマルウェアです。 攻撃者はマルウェアの内部に固定のサーバーアドレスを持たせず、接続情報をEthereumやTONに保存し

趨勢科技發現鎖定日本旅館的惡意軟體攻擊活動，駭客針對與Booking.com合作的旅館，向員工發送網釣郵件，散布遠端存取木馬（RAT）TONResolver

A new wave of cyberattacks targeting Japan’s hospitality sector has put the global threat landscape on high alert. In late May 2026, attackers began sending phishing emails to Japanese partner companies of Booking.com, disguised as urgent guest complaints and review requests. The goal was to trick hotel staff into opening malicious files that handed remote control of their systems to an attacker. What makes this campaign alarming is how the malware operates. Instead of hardcoding a command-and-control server, the attackers used The Open Network (TON) blockchain as a “dead drop resolver,” a technique that lets them update the server address at any time without touching the malware itself. This makes the threat far harder to detect or shut down once inside a network. Analysts at Trend Micro identified the malware, naming it TONResolver, and confirmed it functions as a Remote Access Trojan (RAT). Trend Micro said in a report  shared with Cyber Security News (CSN) that infected endpoints remain in a persistent keepalive loop, staying connected and ready to receive attacker commands for as long as the infection is active. Telemetry confirmed Japan as the most heavily impacted region. Two delivery methods were observed. The first was bulk phishing with subject lines such as “Important: Guest Stay Review Request.” The second was a “conversational attack” through Gmail, where the attacker sent an innocent inquiry, waited for a reply, then followed up with a malicious link. Building trust before delivering the payload is a tactic commonly linked to advanced persistent threat groups. Email sample generated by organizing information from reported emails (Source – Trend Micro) The impact of a successful infection extends beyond the initial entry point. Once TONResolver runs, it collects the victim’s username, hostname, operating system, CPU count, memory, and MAC address. Follow-on activity confirmed through managed detection and response analysis revealed credential theft attempts, with the malware targeting browser-stored passwords, cookies, history, and autofill data from Chrome and Edge. TONResolver Malware Uses TON Smart Contracts The defining technical feature of TONResolver is how it locates its command-and-control server. Rather than embedding a fixed address, the attackers stored the C2 domain inside a TON smart contract. When the malware runs, it contacts tonapi[.]io via a method called “get_domain” to retrieve the current live server address. This gives attackers a critical advantage. If a C2 server is blocked or taken offline, they update the domain inside the TON contract and all infected machines automatically reconnect to the new server with no change to the malware itself. Transaction history analysis confirmed multiple C2 domain switches, showing this mechanism was actively exploited throughout the campaign. The payload is a JavaScript file executed through Node.js, a legitimate and widely trusted platform. VM-based obfuscation converts the logic into a custom virtual instruction set that defeats static analysis. Files contained in the zip archive (Source – Trend Micro) All traffic is encrypted using WebSocket with ECDH key exchange and AES-256-CBC, making packet-level inspection largely ineffective against this threat. Infection Chain and Persistence Tactics The attack begins when a victim clicks a hyperlink in the phishing email, downloading a zip archive from a malicious website. Inside is a shortcut file (.LNK) disguised as a photo, and clicking it triggers a PowerShell command that fetches a PS1 script from the attacker’s server and launches the full infection chain. The PS1 script deploys the JavaScript payload and silently downloads Node.js from nodejs.org to serve as the execution environment. The malware sets a Windows registry Run key for persistence and uses a mutex check to prevent duplicate instances. This blend of malicious and legitimate behavior helps it evade many standard security tools. Organizations should act without delay. Trend Micro recommends restricting connectivity to the TON platform, as blocking tonapi[.]io can cut the dead drop resolver link entirely. Configuring PowerShell to block external file retrieval and monitoring for Node.js running from AppData paths are also strongly advised. Reviewing configurations, strengthening endpoint monitoring, and refreshing incident response procedures are essential steps for organizations that could be targeted in this ongoing campaign. Indicators of Compromise (IoCs):- Type Indicator Description URL https://tonapi[.]io/v2/blockchain/accounts/0:c6611f0e5635c43804 41da7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a8d9/methods/get_domain TON API endpoint used by malware to resolve C2 server domain (dead drop resolver)  TON Contract Address 0:c6611f0e5635c43804 41da7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a8d9 TON smart contract used as dead drop resolver storing current C2 domain  TON Contract Address 0:6d5b44d0697e6bd6703f2cabd2531ccf5a0b11cc081f8f171a75bd679db4c12d41 Attacker-controlled TON contract used to update C2 server domains  Detection Name TrojanSpy.JS.TONRESOLVER.A Detection name for the TONResolver JavaScript RAT payload  File Path %USERPROFILE%\AppData\Local\Nodejs\{filename}.js Location where the malicious JavaScript payload is saved on victim endpoints  File Path %USERPROFILE%\AppData\Local\Nodejs\node-v24.13.0-win-x64\ Directory where Node.js is deployed by the malware for payload execution  URL https://nodejs[.]org/dist/v24.13.0/node-v24.13.0-win-x64.zip Legitimate Node.js download URL abused by the malware to fetch the execution environment  Registry Key HKCU\Software\Microsoft\Windows\CurrentVersion\Run Registry Run key set by TONResolver for persistence on victim systems  Domain tonapi[.]io Legitimate TON API domain abused as communication channel for C2 domain resolution  Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM .  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. ->  Integrate ANY.RUN With Your SOC  Now . The post TONResolver Malware Uses TON Smart Contracts as Dead Drop Resolver for C2 Switching appeared first on Cyber Security News .

Introduction: When a Guest Complaint Becomes a Cyber Weapon The hospitality industry thrives on trust. Every guest review, booking confirmation, and customer complaint is part of daily business. Unfortunately, cybercriminals understand this better than anyone. Instead of attacking hotel infrastructure directly, they are now exploiting the very communication channels hotel employees rely on every day. A newly uncovered cyber campaign demonstrates how sophisticated phishing attacks have evolved beyond fake invoices and generic spam emails.

TONResolver RAT phishes Booking.com hotel partners in Japan, using TON blockchain dead drops to hide C2 and enable remote access.

Japan’s hotel sector is the latest target of a sophisticated phishing and remote-access trojan (RAT) campaign that leverages guest-complaint lures.