YouTube video by Cooper

🔍 Contexte de découverte L'investigation a débuté suite à une alerte Microsoft Defender for Endpoint signalant une activité suspecte de capture d'écran via PowerShell.

Technical blog by Stephan Berger (@malmoeb)

Hackers are targeting hotels with fake guest complaints and negative reviews that lead staff to malware disguised as photographic evidence. The campaign delivers EtherRAT or TONResolver, two malware …

Hackers are targeting hotels with fake guest complaints and negative reviews that lead staff to malware disguised as photographic evidence. The campaign delivers EtherRAT or TONResolver, two malware families that use public blockchains to find their command and control servers instead of relying on a fixed address inside the malware. The emails reach front desk, reservations, and guest relations teams, where handling customer concerns is part of daily work. Messages describe dirty rooms, disputes with employees, or possible legal action. Links offer supposed photos, videos, or documents, turning pressure to protect a hotel’s reputation into a reason to open dangerous files. Researchers from Cofense identified EtherRAT and TONResolver in these campaigns and detailed their findings in an October 7 report by intelligence analyst Kahng An. They assess with moderate confidence that the activity continues earlier Booking.com phishing campaigns, although shared malware tools used by separate groups could also explain the similarities. Hackers Use Negative Hotel Reviews Earlier attacks used fake booking messages and ClickFix pages that asked staff to paste commands into the Windows Run window. Those campaigns commonly delivered PureRAT or NetSupport Manager. Previous reporting on compromised hotel booking accounts shows how hotel infections can support wider fraud, but Cofense does not confirm that outcome here. A sample Booking.com-spoofing email (Source – Cofense) The newer emails link to an archive containing a malicious Windows shortcut, or LNK file, disguised as a JPG image. Opening it runs code rather than showing a photograph. The archive also includes a dummy MP4 file whose size changes with each download, likely producing different hashes that weaken fixed file signature checks. The shortcut downloads Node.js, a legitimate environment for running JavaScript, and installs either malware family. Both use this runtime. Cofense says this shared approach suggests a possible common loader, not proof of one operator. Researchers also assess with moderate confidence that attackers use generative AI to vary the wording of their emails. How EtherRAT and TONResolver Find C2 Servers EtherRAT reads an Ethereum smart contract through a public JSON-RPC service, using a request such as eth_call . It decodes the returned hexadecimal data and removes light masking to recover the current C2 domain or IP address. Earlier coverage of EtherRAT blockchain hiding techniques explains this same design in other attacks, without establishing who runs this hotel campaign. TONResolver follows the same basic process using a public TON blockchain API and data tied to a wallet or smart contract. Reporting on TONResolver smart contract abuse previously described hotel phishing with similar delivery methods. The key distinction is which blockchain supplies the address, not whether the malware still needs an external command server. A recent email that delivers TONResolver (Source – Cofense) This approach is called blockchain dead drop resolving. The blockchain stores directions to C2 infrastructure; it is not itself the server issuing every command. Operators can publish a new destination through a transaction, allowing existing infections to locate replacement servers without receiving a new malware file. That weakens takedowns aimed only at domains or hosting accounts. Removing a server does not erase the blockchain record that points infected devices toward its replacement. Public blockchain API requests can also resemble legitimate wallet traffic. Cofense notes that blocking Ethereum access alone may leave TON access available in campaigns using the other family. Hotel teams should examine unexpected complaint links with the same care as other unsolicited messages, even when a sender threatens immediate consequences. Cofense recommends training staff to spot malicious emails rather than relying only on fixed wording or hashes. The report also warns that public customer support, sales, and business development inboxes face similar risks. Security teams should also investigate unexpected Node.js activity on hotel workstations and link endpoint findings with email evidence. A legitimate runtime or blockchain service should not make a suspicious download appear safe to staff automatically. Indicators of compromise (IoCs):- Malware Indicator type Source value EtherRAT Ethereum contract 0x277852e1C349b03c79E348018a8391bD21C412E8 EtherRAT C2 URL hxxps[://]gateway001kir[.]com EtherRAT C2 URL hxxps[://]sslgateway001[.]com EtherRAT C2 URL hxxps[://]waygatterol002[.]com EtherRAT C2 URL hxxps[://]lotus-vista-additions-joshua[.]trycloudflare[.]com EtherRAT C2 URL hxxps[://]perrine90-deltajohnsons[.]com EtherRAT C2 URL hxxps[://]kadmecnp-643laolmd[.]com EtherRAT C2 URL hxxps[://]lermontov-656idlop[.]com EtherRAT C2 URL hxxps[://]dns1[.]southafricanorth[.]cloudapp[.]azure[.]com EtherRAT C2 domain fdffofofofo4[.]com EtherRAT C2 URL hxxps[://]update[.]norwayeast[.]cloudapp[.]azure[.]com EtherRAT C2 URL hxxps[://]allres[.]southafricanorth[.]cloudapp[.]azure[.]com EtherRAT C2 URL hxxps[://]synctimes[.]australiaeast[.]cloudapp[.]azure[.]com EtherRAT C2 URL hxxps[://]opencode-setup-al[.]com EtherRAT C2 URL hxxps[://]luxmaxing[.]southafricanorth[.]cloudapp[.]azure[.]com TONResolver TON contract 0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9 TONResolver C2 domain amanohuguta[.]cfd TONResolver C2 domain hsaertyuoang34[.]sbs TONResolver C2 domain zloapobikahy23[.]bond TONResolver C2 domain tonajukbhuakpo2[.]shop TONResolver C2 domain njzlopghznkamkl[.]cfd TONResolver C2 domain nuypoiaklber[.]lol Note:   IP addresses and domains are intentionally defanged (e.g.,  [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM . Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC The post Hackers Use Negative Hotel Reviews to Spread Malware That Hides C2 on Blockchain appeared first on Cyber Security News .

ハッカーが、偽の宿泊客クレームや否定的なレビューを使ってホテルを標的にし、「EtherRAT」と「TONResolver」という2種類のマルウェアを配布しています。いずれも公開ブロックチェーンを悪用して、コマンド＆コントロール（C2）インフラの所在を突き止める点が特徴です。Cybersecurityadvisory

このメールは、EtherRATまたはTONResolverというマルウェアを送り付けます。いずれも公開ブロックチェーンを利用して、コマンド&コントロール（C2）サーバーの所在を突き止める仕組みを持つマルウェアです。 攻撃者はマルウェアの内部に固定のサーバーアドレスを持たせず、接続情報をEthereumやTONに保存し

Researchers from Unit 42 identified a social engineering campaign where attackers impersonate IT support staff via Microsoft Teams to trick employees into installing the EtherRAT malware on Windows systems. The threat actors initiate fake support calls, leveraging the platform’s communication features to gain trust and deploy the remote access trojan. No specific dates, affected versions, or technical indicators (e.g., CVE IDs) were disclosed in the report. The malware enables unauthorized access and control over compromised endpoints, though the exact impact on victims remains unspecified. The attack vector exploits human interaction rather than a software vulnerability.

At a Glance Malware family: Multiple families including ModeloRAT, EtherRAT, AsukaStealer, and C2Looper Threat actor: Suspected initial access broker Woodgnat (KongTuke) and unnamed cybercrime groups Target or victims: Technology firms, fintech companies, hotels, and government agencies Delivery vector: ClickFix fake update prompts and malicious PowerShell commands Key capabilities: Living-off-the-land execution, registry persistence, and blockchain-based EtherHiding Source: Symantec Threat Hunter Team and Zscaler…

A new malware implant called EtherRAT, deployed in a recent React2Shell attack, runs five separate Linux persistence mechanisms and leverages Ethereum smart contracts for communication with the attack...

Threat actors are abusing Microsoft Teams voice calls by impersonating corporate IT support staff to trick employees into installing the EtherRAT malware, giving attackers initial access to corporate networks. [...]

A new malware implant called EtherRAT, deployed in a recent React2Shell attack, runs five separate Linux persistence mechanisms and leverages Ethereum smart contracts for communication with the attacker. [...]