Hackers Turn TON Blockchain Into a Resilient C2 Directory for Node.js Backdoor

The attack uses malicious Windows shortcut files, PowerShell, a legitimate Node.js runtime, and the TON blockchain to maintain a flexible command-and-control (C2) system.

The campaign shows how attackers are increasingly combining trusted services, legitimate software, and blockchain-based infrastructure to complicate detection and takedown efforts.

Blockchain-hosted C2 mechanisms can act as resilient “dead-drop” resolvers because operators can change instructions without rebuilding or redistributing the malware.

TON Hosts Backdoor C2

The infection starts with spam emails carrying booking-related themes. Victims receive a Google Share link that redirects to a malicious website, such as recordstrace[.]info, and then offers a ZIP archive for direct download or via a ClickFix-style prompt.

The ZIP file contains a malicious .lnk shortcut disguised as an image by using an icon from Windows’ shell32.dll. When opened, the shortcut silently launches an obfuscated PowerShell command.

Instead of storing its download address as readable text, the LNK file stores it as two large integers.

The embedded script subtracts one value from the other, then reconstructs the domain one byte at a time through bitwise operations or equivalent modulo and division logic. In one analyzed sample, this process revealed recordstrace[.]info.

The PowerShell payload checks whether node.exe already exists on the device. If Node.js is absent, it downloads the legitimate Windows Node.js package from the official Node.js distribution infrastructure.

It extracts it into the user’s LocalAppData folder. This use of a trusted runtime can help the attackers blend into normal application activity.

Next, the script decrypts an AES-128-CBC and Base64-protected JavaScript payload. It then launches the backdoor with the newly installed or existing Node.js executable, passing the decrypted C2 data as an argument.

The JavaScript implant is heavily obfuscated and uses a custom virtual machine interpreter to execute encoded bytecode rather than standard JavaScript. This design raises the effort needed for static malware analysis and signature-based detection.

Researchers identified historical C2 domains including tonajukbhuakpo2[.]shop, zloapobikahy23[.]bond, hsaertyuoang34[.]sbs, and amanohuguta[.]cfd.

This approach lets operators replace blocked infrastructure by updating blockchain-hosted data, without changing the malware already deployed on victim systems.

Attackers specifically value on-chain C2 designs for this resilience against conventional domain blocking and takedown actions. The malware can download Windows executables, PowerShell scripts, and JavaScript.

Before running an executable, it validates the Windows PE header, saves the file under a random name in %TEMP%, and can attempt to add a Microsoft Defender exclusion for the file path before execution, LevelBlue said.

Defenders should monitor booking-themed emails containing Google Share links, suspicious ZIP archives, and LNK files masquerading as images.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.