Technical Analysis of Suspicious Emails Targeting the Hotel Industry

A sophisticated multi-stage malware campaign is targeting the hotel sector through emails disguised as Booking.com notifications. The intrusion chain combines malicious LNK files, PowerShell scripts, and a Node.js-based remote access trojan known as TonRAT. One of the most notable aspects of the operation is its use of The Open Network (TON) API to obtain command-and-control domains dynamically, which makes traditional domain-based blocking less reliable.

The investigation uncovered a layered execution flow in which an initial ZIP archive contains an LNK file that launches PowerShell to retrieve a secondary script. That script decrypts a JavaScript payload identified as TonRAT using AES and runs it through a legitimate Node.js runtime downloaded from nodejs.org . Once active, the malware initiates WebSocket-based command-and-control communications using domain information pulled from TON blockchain API requests.

Recommended defenses include restricting PowerShell execution, closely monitoring for unauthorized use of the Node.js runtime ( node.exe ), and detecting abnormal WebSocket traffic. Organizations should also watch for connections to the TON API, including tonapi.io , and strengthen email filtering to catch spoofed domains, suspicious attachments, and phishing lures aimed at hotel staff.

If compromise is suspected, security teams should isolate the affected endpoint immediately to prevent additional command-and-control traffic and possible data exfiltration. PowerShell operational logs and process execution records should be reviewed for unauthorized node.exe activity. A forensic sweep should also be performed for the known TonRAT JavaScript hashes, along with investigation of any connections to the identified command-and-control infrastructure.

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

Attack Narrative & Commands: The adversary aims to establish a WebSocket-based Command and Control (C2) channel. To blend in with legitimate traffic, the malware first queries the tonapi.io service to resolve its C2 infrastructure. Once the “legitimate” API interaction is established, the malware initiates a WebSocket handshake ( wss:// ) to the hardcoded malicious domain zloapobikahy23.bond . This sequence is designed to leverage the reputation of the TON API to mask the subsequent malicious connection.

Regression Test Script:

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.