TONResolver RAT Targets Japanese Hospitality Sector via Booking.com Phishing

What Happened

Security researchers identified a malicious phishing campaign launched in May 2026 specifically targeting the Japanese hospitality industry. The attackers weaponized accommodation-themed lures, specifically leveraging Booking.com communications, to trick personnel into opening malicious attachments or links. The campaign delivers a novel remote access trojan known as TONResolver RAT.

Attack Mechanics

Unlike traditional malware that relies on standard HTTP or HTTPS command-and-control (C2) infrastructure, the TONResolver RAT uniquely abuses the TON (The Open Network) blockchain for its operations. This blockchain-backed mechanism allows the threat actors to obfuscate traffic, evade standard perimeter detection controls, and maintain resilient communication channels with compromised systems.

Impacted Entities

Hotels, ryokans, and other accommodation facilities in Japan represent the primary target demographic for this campaign. Because these businesses frequently process sensitive customer reservation data and financial transactions through portal accounts, a successful compromise exposes both operational networks and guest privacy.

What Defenders Should Do

SecOps and sysadmins managing infrastructure in the hospitality sector should take immediate defensive actions:

• Monitor email gateways for spear-phishing messages mimicking Booking.com and reservation management platforms.
• Inspect endpoint telemetry for unauthorized processes interacting with blockchain networks or unusual outbound connection patterns.
• Conduct security awareness training focusing on reservation-themed social engineering tactics targeting front-desk and administrative staff.
• Verify that EDR and SIEM rules are updated to flag suspicious script execution and anomalous network traffic signatures associated with emerging RAT families.