Cyber Threats TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry In this blog entry, TrendAI™ Research examines a wave of phishing emails observed in May 2026 that targeted Japanese accommodation facilities using Booking.com, detailing the victims, attack techniques used, and characteristics of the malware involved. By: Yuya Sato Jun 29, 2026 Read time: ( words) Save to Folio Key takeaways Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files. Multiple email delivery methods were observed, including bulk phishing and interactive conversational attacks via Gmail that build initial trust before delivering a malicious URL. The malware, TONResolver, appears to function as an initial access and command-execution foothold, and observed follow-on activity indicates potential credential theft and further compromise. By storing the C&C server domain in a TON smart contract, attackers can swap in a new server at any time, even if the current one is blocked or taken down. In late May 2026, suspicious emails were identified being sent to Japanese partner companies of Booking.com, with the subject line “Important: Guest Stay Review Request” (重要：ゲスト滞在レビュー依頼). In this attack, a zip file was downloaded by accessing a hyperlink to a suspicious web site, and the infection began when the user clicked a shortcut link file (LNK) disguised as a photo file within the zip archive. Unlike conventional phishing campaigns, the malware abuses The Open Network (TON) blockchain platform as a dead drop resolver, a technique that allows attackers to update their command-and-control (C&C) server destination without hardcoding it into the malware, making detection and takedown significantly more difficult. Upon examining the access patterns of the domain group (CFD TLD, described later in this blog entry) hosting the suspicious web sites listed in the email links, TrendAI™ telemetry confirmed that accesses from the Japan region were the most prevalent. Endpoints infected with the malware, identified as TrojanSpy.JS.TONRESOLVER.A, remain in a persistent Keepalive loop awaiting attacker commands, so the risk of credential theft and additional malware deployment continues so long as the infection is active. Figure 1. Telemetry plot results from May 17 to June 8 download Characteristics of the phishing emails In the observed attacks targeting Japan, two types of subject lines were identified. By framing the messages as “customer complaints” in the hospitality industry and requesting link clicks and photo viewing, the intent to deceive hotel employees and operators into executing the malicious content was apparent. These emails were confirmed to have been sent using the notification functionality of a scheduling tool service. As a result, defense based solely on domain authentication technologies such as Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) was insufficient to prevent receipt of these emails. 重要：ゲスト滞在レビュー依頼 (Important: Guest Stay Review Request) 【重要】お客様からの重大な苦情に関するご連絡 (Important: Notification Regarding a Serious Complaint from a Guest) In addition to the subject lines, distinguishing characteristics were identified in the hyperlink text strings contained in the emails, with the following multiple strings observed: Download Photos and Videos 証拠写真・動画を確認する (View Evidence Photos and Videos) 添付資料を確認する (View Attached Materials) Figure 2. Email sample generated by organizing information from reported emails (Japanese) download Translated from Japanese, the email sample in Figure 2 reads as follows: Booking.com Partner Support A serious complaint has been received from a guest who stayed at your property from May 11 to May 14, 2026. We kindly ask that you review this matter promptly and take the necessary action. Content of the guest's complaint: "Bed bugs were discovered in the room, and my daughter was bitten multiple times during our stay. Concerned about health risks, we visited a medical facility. Photos of the bed bugs are attached as evidence. We strongly request an immediate response." The guest's name, contact information, reservation number, exact dates of stay, and all evidence related to the complaint are available for download via the link below. Download Photos and Videos All information and materials necessary for investigation and prompt response regarding this serious matter are included in the attachment, so please review the contents carefully. Booking.com Customer Service Team An English-language email was also observed. Despite being directed at domestic organizations, this attack is presumed to target English speakers. Only one subject line was identified: “Urgent: Bed bug complaint from guest". Investigation of the hyperlink destination infrastructure and malware revealed information linking this campaign to different emails, and tactics abusing Gmail as a sender were also observed. In these attacks, we observed a “conversational attack” method used. In this approach, the attacker first sent a normal inquiry email without a URL to the accommodation facility’s contact person, and after receiving a reply, sent a follow-up email containing a hyperlink with a malicious URL. The tactic of gaining the target’s trust through initial correspondence rather than sending a malicious URL in the first email is a technique also common to advanced persistent threats (APTs). The subject lines observed in Gmail emails are listed below; no Japanese-language ones were found. However, given the characteristics of initiating correspondence while posing as a normal customer using Gmail, caution is warranted as this technique may be employed in future attacks beyond this investigation. Below is a list of examples of subject lines used in interactive attacks via Gmail , with {number} containing arbitrary numbers, and {English name} containing strings presumed to be non-Japanese personal names: Accommodation Inquiry – {number} Amazing Anniversary visit Extras Costs? Assessing Hotel Room Availability Availability Confirmation Needed Checking Available Hotel Rooms Checking Hotel Availability for Stay Disappointed with Room Service Hotel Accommodation Availability Inquiry Hotel Accommodation Request Hotel Booking Availability Status Hotel Booking Possibilities Check Hotel Booking Request Hotel Reservation Availability Inquiry Hotel Rooms: Availability Status Hotel Stay Availability Verification Inquiry About Hotel Stay Options Inquiry for Hotel Stay Availability Inquiry: Availability and Total Cost Looking at Hotel Room Reservations Looking for Hotel Vacancies Quick Availability Question Request for Booking Options Room Inquiry ({number}) Short Stay Availability Check Unacceptable Room Condition Unacceptable Room service Very bad experience with room service {English name} {number} Multiple types of delivery infrastructure used by attackers Along with multiple email delivery methods, trends were also identified in the initial payload distribution domains that the attackers prepared to redirect victims from emails. Domains linked to the same attacker (or attack group) fell into four top-level domain (TLD) groups, all of which delivered the same initial payload on request. Figure 3. Duration of domain creation per TLD group (Observation results through June 8) download All TLD groups implemented a mechanism whereby accessing the URL “http://{domain name}/v” triggered the download of a .ZIP file, and it was confirmed that domains were used selectively based on the target email addresses. These observed domains abused Cloudflare’s infrastructure and used the Cloudflare Name Server pair “galilea” and “moura”. Cloudflare DNS always assigns two name server names per account. Because the probability of two different users receiving the same pair is low, domains sharing a name server pair can be presumed to belong to the same attacker. For domains created from June onward, the pair changed to “brianna” and “roan”, suggesting that the zones within the account or management procedures may have changed for some reason. Our investigation of URLs from observed emails and domains revealed the classification shown in Figure 4. As described above, the .COM TLD group was the only one where Registrant (domain registrant) characteristics were uniquely identified. The “ghastlier” domain used in the Registrant Email is a disposable email domain, making long-term continued use difficult. The attacker appears to have set these values for the Registrant Name and Registrant Email. Figure 4. Results of investigating .COM domains using whois download Infection chain via user execution The infection begins when a user downloads a zip file via a hyperlink in the email and executes a shortcut link file (LNK) disguised as a photo (PNG) file contained within the archive. Figure 5. Files contained in the zip archive download The PowerShell command embedded in the LNK file handles two large integers as [System.Numerics.BigInteger] and computes their difference. The resulting value is then repeatedly divided by 256, with each remainder converted to a single-byte character (Char), thereby reconstructing the destination domain. The script then executes Invoke-WebRequest against the reconstructed domain, saves the retrieved PS1 file (PowerShell script file) under "%TEMP%", and executes it with PowerShell. [System.Numerics.BigInteger] has been used from June onward; prior to the end of May, it was defined using [bigint]. Figure 6. Large integer processing using [bigint], employed until the end of May download Figure 7. Large integer processing using System.Numerics.BigInteger, employed from June onward download When communicating externally to retrieve the PS1 file, the domain name generated via System.Numerics.BigInteger connec