From Guest Complaints to Malware: Blockchain Abuse Targets Hotels

Cofense Intelligence details a campaign targeting hotels that uses fake guest complaints and negative-review lures to deliver LNK shortcut files which install EtherRAT or TONResolver via a NodeJS runtime; both malware families query public Ethereum or TON blockchain data to resolve takedown-resistant C2 addresses, enabling low-cost rotation and persistent infections while evading conventional domain/IP takedowns.