TONResolver RAT Abuses TON Blockchain to Target Japan's Hotel Industry

Key takeaways

Attackers are targeting employees of Booking.com partner companies in Japan, using phishing emails that impersonate guest complaints and review requests to trick hotel staff into executing malicious files.

Multiple email delivery methods were observed, including bulk phishing and interactive conversational attacks via Gmail that build initial trust before delivering a malicious URL.

The malware, TONResolver, appears to function as an initial access and command-execution foothold, and observed follow-on activity indi…