TonRAT / "Photo-ZIP" Hospitality Campaign

Microsoft (2026-06-25) reported a campaign — active since April 2026 and not yet attributed to a known actor — that targets the hospitality sector (front-desk, reception, reservations staff at hotels) in Europe and Asia. The intrusion is themed around guest photos and complaints: victims download a photo-themed ZIP (photo-<random>.zip) that contains a fake image shortcut (IMG-*.png.lnk / PHOTO-*.png.lnk). Opening the LNK launches powershell.exe -ep bypass running an obfuscated BigInt-arithmetic decoder, which pulls a .ps1 to %TEMP%, drops a legitimate Node.js runtime into AppData\Local\Nodejs, and runs node.exe with a JavaScript implant tracked as TonRAT.

TonRAT's distinguishing trait is C2 resolution via the TON blockchain API — it reads attacker-controlled domains from on-chain records, then opens an encrypted WebSocket on non-standard ports (8443, 8445, 8453, 5555, 56001–56003). Persistence is dual: Run (Node.js component) and RunOnce (ProgramData EXE). The actor laundered sender authentication through abused Calendly + a Google share redirect chain so phishing passes SPF/DKIM/DMARC/CompAuth.

The strongest defensive angle is endpoint behavior: a signed-but-living-off-the-land chain (LNK → PowerShell → iwr → node.exe from a non-standard path) plus Run/RunOnce writes and a Defender exclusion add. Falcon EDR covers this well; this pack leans into process-lineage and registry CQL hunts rather than network signatures alone, because the blockchain-resolved C2 rotates.

Defender priority: Hunt for node.exe executing from C:\Users\*\AppData\Local\Nodejs\*.js with a domain argument — this is the implant launch and the single highest-fidelity signal in the chain. Pair it with the LNK→PowerShell→iwr ancestry hunt to catch the delivery stage.

Hunter notes: Microsoft did not attribute the campaign to a named actor. Two waves are described: Wave 1 (IMG-*.png.lnk, fixed-IP C2, .info domains) and Wave 2 (PHOTO-*.png.lnk, Cloudflare-fronted photo-*.cfd, csc.exe→cvtres.exe compile-after-delivery). All IOCs in this pack trace to the Microsoft primary source. Blockchain-resolved C2 means domain/IP IOCs are perishable — prioritize behavioral hunts.

Hunt hypotheses (high-fidelity first)

1. H1 — Implant launch: node.exe runs from AppData\Local\Nodejs\*.js with a domain argument. CONF HIGH Covers T1059.007. Requires ProcessRollup2.
2. H2 — LNK delivery: A .lnk spawns powershell.exe -ep bypass whose command line contains iwr/Invoke-WebRequest + -OutFile. CONF HIGH T1059.001 / T1204.002.
3. H3 — PS1 drop to TEMP: PowerShell writes a randomly-named .ps1 into %TEMP%. CONF MED T1059.001 / T1105.
4. H4 — Run/RunOnce persistence: Registry value write under ...\CurrentVersion\Run or RunOnce pointing at a Node.js component or a ProgramData\<random>\*.exe. CONF HIGH T1547.001.
5. H5 — Defender exclusion abuse: Add-MpPreference -ExclusionProcess targeting a %TEMP%\<random>.exe. CONF HIGH T1562.001.
6. H6 — Compile-after-delivery (Wave 2): csc.exe → cvtres.exe producing a .dll, parented from the PowerShell/Node chain. CONF MED T1027.004.
7. H7 — Non-standard-port C2 + geo lookup: Outbound to ports 8443/8445/8453/5555/56001–56003 or to ip-api.com, from node.exe / dropped EXE. CONF MED T1571 / T1016.
8. H8 — Known-bad atomic IOCs: Listed SHA256 hashes, Wave-1 C2 IPs, and campaign domains. CONF HIGH (perishable for net IOCs).

Attack chain

Network IOCs are perishable — C2 is resolved on-chain and rotates; Wave-2 fronts behind Cloudflare. Treat IPs/domains as hunt/enrich, not permanent detect. All values below trace to the Microsoft primary source.

Email gateway / M365

• Hunt inbound mail from *.calendly.com senders with display name containing Booking Manager / (via Calendly) to reception/reservations mailboxes — especially where the body links into a share.google/ → google.com/share_google redirect chain.
• Flag links resolving to photo-*.cfd / *.click / *.bond or a Cloudflare Turnstile gate. Note: these pass SPF/DKIM/DMARC/CompAuth — do not rely on auth verdicts alone.
• Target accounts to watch (lure recipients): reception, frontdesk, recepcja, recepce, accueil. Lure languages: Japanese, Danish, Dutch.

Windows PowerShell logging (Event ID 4104 ScriptBlock)

• Search ScriptBlock text for BigInt arithmetic patterns and Invoke-WebRequest/iwr with -OutFile writing to $env:TEMP.
• Confirm ScriptBlock logging (GPO: Turn on PowerShell Script Block Logging) is enabled fleet-wide — front-desk images often miss it.

Microsoft Defender

• Review Defender exclusion change events (Operational log) for newly added -ExclusionProcess entries pointing at %TEMP% EXEs.

Promotion path: Q1 and Q2 are the strongest IOA candidates (low FP, attacker-specific path/lineage). Deploy in Detect on a pilot ring of front-desk hosts, confirm zero benign hits over a baseline window, then escalate Q1 to Block.

Grouped quick-copy blocks for direct ingestion / triage. Network IOCs are perishable — set short expirations and prefer detect on hashes, hunt on net infra.

type,value,action,severity,expiration,description,tags
sha256,04ec44f2618460f5c77c5e56014a512cc03a123c9c5b6b6b1273e2a1681ac2e1,prevent,critical,2026-12-27,TonRAT PE xmnrwv9l.exe,campaign:TonRAT-PhotoZIP
sha256,9f10e3b6e5745784f26d18c38ce01fba054b19749c17260978ac11472564aee2,prevent,critical,2026-12-27,TonRAT LNK Wave1,campaign:TonRAT-PhotoZIP
sha256,97448688b292bfec6d83b153588076fe59b111c35ac4e42a916238df16a71e2f,prevent,critical,2026-12-27,TonRAT LNK Wave2,campaign:TonRAT-PhotoZIP
sha256,c5baa0c16b0074a1e94b48aa0177e9bfc23746aca8a5b42848a6685da85658b5,prevent,critical,2026-12-27,TonRAT PS qFWe908J.ps1,campaign:TonRAT-PhotoZIP
sha256,b7f46b192cd83a1d2487cb048cca645f6e8855b9673d500d50bbdb04eebc6bea,prevent,critical,2026-12-27,TonRAT DLL bjygtujc.dll,campaign:TonRAT-PhotoZIP
ipv4,178.16.54.27,detect,high,2026-09-27,TonRAT Wave1 C2,campaign:TonRAT-PhotoZIP
ipv4,95.217.97.121,detect,high,2026-09-27,TonRAT Wave1 C2,campaign:TonRAT-PhotoZIP
ipv4,193.202.84.32,detect,high,2026-09-27,TonRAT Wave1 C2,campaign:TonRAT-PhotoZIP
ipv4,178.16.55.179,detect,high,2026-09-27,TonRAT Wave1 C2,campaign:TonRAT-PhotoZIP
domain,safedocphoto.info,detect,high,2026-09-27,TonRAT Wave1 C2,campaign:TonRAT-PhotoZIP
domain,recallnine.info,detect,high,2026-09-27,TonRAT Wave1 C2,campaign:TonRAT-PhotoZIP
domain,kentjerk.info,detect,high,2026-09-27,TonRAT Wave1 C2,campaign:TonRAT-PhotoZIP
domain,photodoc-secure.info,detect,high,2026-09-27,TonRAT Wave1 C2,campaign:TonRAT-PhotoZIP
domain,sec-safe-dc.info,detect,high,2026-09-27,TonRAT Wave1 C2,campaign:TonRAT-PhotoZIP

node.exe executing *.js from C:\Users\*\AppData\Local\Nodejs\ + domain arg
*.png.lnk (1989-2079 bytes) -> powershell.exe -ep bypass -> iwr -OutFile %TEMP%\*.ps1
Run/RunOnce value data referencing Nodejs OR C:\ProgramData\<random>\*.exe
Add-MpPreference -ExclusionProcess %TEMP%\<random>.exe
csc.exe -> cvtres.exe compiling a .dll on a non-developer host (Wave 2)
Inno-Setup is-*.tmp installer launched with /SL5 /VERYSILENT
Outbound encrypted WebSocket to ports 8443/8445/8453/5555/56001-56003

Implant: TonRAT (Node.js / JavaScript; TON-blockchain C2 resolution)
Legit runtime abused: node-v24.13.0-win-x64 (sha256 d14ba95cdce1ef7dc9ad3ac74949ca5db38b27378ee30f30a23cf26f9e875a11)
Wave 2 C2 pattern: photo-<digits>.cfd  (TLDs .cfd / .click / .bond; Cloudflare-fronted; Turnstile gate)
Geo lookup: ip-api.com (208.95.112.1)
Auth laundering: em1618.calendly.com / "Booking Manager (via Calendly)"
  redirect chain: calendly.com/url?q= -> share.google/TOKEN -> www.google.com/share_google -> photo-*.cfd
Lure recipients: reception, frontdesk, recepcja, recepce, accueil (JP/DA/NL lures)

[ ] ASR: Block executable content from email client and webmail (BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550)
[ ] ASR: Block JavaScript/VBScript from launching downloaded executable content (D3E037E1-3EB8-44C8-A917-57927947596D)
[ ] ASR: Block process creations originating from PSExec and WMI commands
[ ] Block/quarantine inbound .lnk and double-extension *.png.lnk at mail gateway
[ ] Mark-of-the-Web enforced; SmartScreen on for downloaded archives
[ ] PowerShell Script Block Logging (4104) enabled on front-desk images
[ ] Tamper Protection ON so Add-MpPreference exclusions cannot be silently added
[ ] Flag inbound *.calendly.com senders with "Booking Manager (via Calendly)" display names

1 · Enable the two key ASR rules (Defender, Block mode)

Add-MpPreference -AttackSurfaceReductionRules_Ids BE9BA2D9-53EA-4CDC-84E5-9B1EEEE46550 -AttackSurfaceReductionRules_Actions Enabled
Add-MpPreference -AttackSurfaceReductionRules_Ids D3E037E1-3EB8-44C8-A917-57927947596D -AttackSurfaceReductionRules_Actions Enabled
# Verify:
(Get-MpPreference).AttackSurfaceReductionRules_Ids
(Get-MpPreference).AttackSurfaceReductionRules_Actions

2 · Enforce Tamper Protection + Script Block Logging (GPO/registry)

# Tamper Protection (managed via Intune/MDE; registry readout to verify):
Get-MpComputerStatus | Select-Object IsTamperProtected
# PowerShell Script Block Logging:
$rk = "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging"
New-Item -Path $rk -Force | Out-Null
Set-ItemProperty -Path $rk -Name EnableScriptBlockLogging -Value 1 -Type DWord
# Verify:
Get-ItemProperty -Path $rk -Name EnableScriptBlockLogging

3 · WDAC/AppLocker — deny node.exe from user AppData (AppLocker EXE rule, deny)

# Audit first, then enforce. Deny rule path condition (AppLocker):
#   %LOCALAPPDATA%\Nodejs\*    and    %OSDRIVE%\ProgramData\*\*.exe
# Set the AppLocker EXE collection to Enabled and add a DENY rule for the paths above.
# Spot-check current effective mode:
Get-AppLockerPolicy -Effective -Xml | Select-String "Exe"

4 · Post-deploy CQL spot-check (behavior gone)

// Confirm no node.exe launching from AppData\Local\Nodejs after enforcement
#event_simpleName=ProcessRollup2
| ImageFileName=/\\node\.exe$/i
| CommandLine=/AppData\\Local\\Nodejs\\/i
| groupBy([ComputerName], function=count())

Known gap: the initial-access / auth-laundering stage (T1566.002, T1199) is not covered by Falcon EDR — it lives in mail-gateway / M365 telemetry. Cover it with the Native Audit-Log Hunts (S7) and the mail rule in S12, not CQL. Validation gates (S11) must pass — confirm telemetry, baseline Q3/Q4/Q6/Q7, and promote Q1/Q2 only after a clean baseline window.