A phishing campaign posing as Booking.com targeted hotel operators in Japan through infrastructure hosted on Calendly and SendGrid. The email included a shortened link that led to a ZIP archive containing a malicious LNK shortcut, which then launched a PowerShell-based loader. That loader retrieved additional PowerShell scripts, decrypted a JavaScript payload identified as TonRAT, downloaded Node.js, and executed the RAT. The malware then established command-and-control through a WebSocket endpoint obtained via the TON API.
The report outlines the email header analysis, the abuse of legitimate delivery services, and the full multi-stage execution chain used in the attack. It provides file hashes for the ZIP archive and its internal components and lists the command-and-control domains observed during analysis. The investigation also includes technical details on the malicious LNK file and the PowerShell commands used to progress the infection.
Defenders should block suspicious Calendly short links, verify sender domains carefully, and restrict execution of LNK attachments delivered through email. Monitoring should also focus on unauthorized PowerShell activity and unexpected Node.js binaries appearing on endpoints. URL filtering can help block access to the known malicious domains involved in the campaign.
Security teams should create detections for PowerShell commands that download content from the identified command-and-control domains and for execution of node.exe from unusual locations. Alerts should also be configured for email flows using SendGrid headers from untrusted or unexpected sources. Investigators should collect dropped files and preserve network traffic associated with the observed WebSocket communications.
Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.
Attack Narrative & Commands:
Initial Access – PowerShell Download The attacker obtains a PowerShell remote session on the compromised host and uses Invoke-WebRequest to pull the TonRAT loader script from a malicious C2 server. This step satisfies the Invoke-WebRequest string match.
Execution of the Loader The downloaded script is executed, which in turn spawns a second PowerShell process to run additional commands (still containing the literal “PowerShell”).
Node.js Payload Execution TonRAT drops a malicious JavaScript file ( malicious.js ) and launches it with the Node.js runtime ( node.exe ). This generates the node.exe string match.
The three process creations (PowerShell with Invoke-WebRequest , PowerShell executing the loader, and node.exe ) collectively satisfy the detection rule’s condition.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
