EtherRAT & TONResolver: Blockchain-Based C2 Campaign Targets Hospitality Sector — OTX Detection Pack

---
title: EtherRAT / TONResolver Blockchain API C2 Resolution
id: 7f3a91c2-4e5d-4a1b-9c8e-2d6f0a1b3c4d
status: experimental
description: Detects non-browser processes initiating network connections to public Ethereum or TON blockchain API endpoints, consistent with EtherRAT/TONResolver blockchain-based C2 resolution.
author: Security Arsenal Threat Intelligence
date: 2026/10/10
references:
    - https://cofense.com/blog/from-guest-complaints-to-malware-blockchain-abuse-targets-hotels
logsource:
    category: network_connection
    product: windows
 detection:
    selection_api:
        DestinationHostname|contains:
            - 'api.etherscan.io'
            - 'eth-mainnet.g.alchemy.com'
            - 'mainnet.infura.io'
            - 'toncenter.com'
            - 'api.ton.cat'
            - 'tonapi.io'
    filter_browsers:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
    condition: selection_api and not filter_browsers
falsepositives:
    - Legitimate cryptocurrency wallet or development tooling
    - Internal blockchain applications (allowlist by process hash)
level: high
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1102
---
title: Malicious LNK Disguised As Image Execution - Hospitality Phishing
id: 8b2c4d6e-1f3a-4b5c-8d9e-0a1b2c3d4e5f
status: experimental
description: Detects execution of LNK shortcut files with image double-extensions and suspicious child processes, matching the EtherRAT/TONResolver hospitality phishing lure pattern.
author: Security Arsenal Threat Intelligence
date: 2026/10/10
references:
    - https://cofense.com/blog/from-guest-complaints-to-malware-blockchain-abuse-targets-hotels
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\explorer.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\mshta.exe'
            - '\cmd.exe'
            - '\wscript.exe'
            - '\rundll32.exe'
    selection_lure:
        CommandLine|contains:
            - '.jpg.lnk'
            - '.jpeg.lnk'
            - '.png.lnk'
            - '.gif.lnk'
            - '.pdf.lnk'
    condition: selection_parent and selection_child and selection_lure
falsepositives:
    - Rare legitimate user-created shortcuts (tune by file path and signer)
level: high
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059.001
---
title: EtherRAT Campaign Known C2 Domain Resolution
id: 9c3d5e7f-2a4b-4c6d-9e0f-1a2b3c4d5e6f
status: experimental
description: Detects DNS queries for known EtherRAT/TONResolver/PureRAT campaign C2 and staging domains from OTX pulse, including Cloudflare Tunnel abuse.
author: Security Arsenal Threat Intelligence
date: 2026/10/10
references:
    - https://cofense.com/blog/from-guest-complaints-to-malware-blockchain-abuse-targets-hotels
logsource:
    category: dns
    product: windows
detection:
    selection:
        query|contains:
            - 'gateway001kir.com'
            - 'sslgateway001.com'
            - 'waygatterol002.com'
            - 'zloapobikahy23.bond'
            - 'perrine90-deltajohnsons.com'
            - 'kadmecnp-643laolmd.com'
            - 'lermontov-656idlop.com'
            - 'lotus-vista-additions-joshua.trycloudflare.com'
    condition: selection
falsepositives:
    - None expected; these are confirmed malicious infrastructure
level: critical
tags:
    - attack.command_and_control
    - attack.t1071

// EtherRAT / TONResolver hospitality campaign hunt - Microsoft Sentinel
// Hunts blockchain API C2 resolution, campaign domains, and LNK lure execution
let CampaignDomains = dynamic([
    "gateway001001kir.com".Replace("001001","001"),
    "sslgateway001.com",
    "waygatterol002.com",
    "zloapobikahy23.bond",
    "perrine90-deltajohnsons.com",
    "kadmecnp-643laolmd.com",
    "lermontov-656idlop.com",
    "lotus-vista-additions-joshua.trycloudflare.com"
]);
let BlockchainAPIs = dynamic([
    "api.etherscan.io", "eth-mainnet.g.alchemy.com",
    "mainnet.infura.io", "toncenter.com", "tonapi.io", "api.ton.cat"
]);
let Lookback = 14d;
let NetHits = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl has_any (CampaignDomains)
       or (RemoteUrl has_any (BlockchainAPIs)
           and InitiatingProcessFileName !in~ ("chrome.exe","msedge.exe","firefox.exe","brave.exe"))
    | project TimeGenerated, DeviceName, RemoteUrl, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteIP, ActionType, HuntSignal="NetworkC2";
let LnkHits = DeviceProcessEvents
    | where TimeGenerated > ago(Lookback)
    | where InitiatingProcessFileName =~ "explorer.exe"
    | where FileName in~ ("powershell.exe","pwsh.exe","mshta.exe","cmd.exe","wscript.exe","rundll32.exe")
    | where ProcessCommandLine has_any (".jpg.lnk",".jpeg.lnk",".png.lnk",".gif.lnk",".pdf.lnk")
    | project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
              InitiatingProcessCommandLine, HuntSignal="LnkLureExec";
let TunnelHits = DeviceNetworkEvents
    | where TimeGenerated > ago(Lookback)
    | where RemoteUrl endswith ".trycloudflare.com"
    | where InitiatingProcessFileName !in~ ("cloudflared.exe")
    | project TimeGenerated, DeviceName, RemoteUrl, InitiatingProcessFileName,
              InitiatingProcessCommandLine, RemoteIP, ActionType="", HuntSignal="CloudflareTunnelAbuse";
union NetHits, LnkHits, TunnelHits
| sort by TimeGenerated desc

# EtherRAT / TONResolver / PureRAT IOC & Artifact Hunt - Security Arsenal
# Run elevated on suspected hospitality endpoints or deploy fleet-wide via EDR/Intune
$ErrorActionPreference = 'SilentlyContinue'
$Report = @()

# 1. DNS cache check for campaign domains
$CampaignDomains = @('gateway001kir.com','sslgateway001.com','waygatterol002.com',
  'zloapobikahy23.bond','perrine90-deltajohnsons.com','kadmecnp-643laolmd.com',
  'lermontov-656idlop.com','lotus-vista-additions-joshua.trycloudflare.com')
$DnsCache = Get-DnsClientCache
foreach ($d in $CampaignDomains) {
    $hit = $DnsCache | Where-Object { $_.Entry -like "*$d*" }
    if ($hit) { $Report += [pscustomobject]@{Type='DNS_CACHE_HIT'; Indicator=$d; Detail=$hit.Data} }
}

# 2. Registry persistence - Run keys referencing blockchain terms or odd paths
$RunKeys = @('HKCU:\Software\Microsoft\Windows\CurrentVersion\Run',
             'HKLM:\Software\Microsoft\Windows\CurrentVersion\Run')
foreach ($key in $RunKeys) {
    Get-ItemProperty $key | ForEach-Object {
        $_.PSObject.Properties | Where-Object {
            $_.Value -match 'ether|tonresolver|purerat|client32|appdata.*\.lnk|blockchain'
        } | ForEach-Object {
            $Report += [pscustomobject]@{Type='REGISTRY_RUNKEY'; Indicator=$_.Name; Detail=$_.Value}
        }
    }
}

# 3. NetSupport Manager RAT artifacts (client32) outside sanctioned installs
$NSPaths = @("$env:ProgramFiles\NetSupport","${env:ProgramFiles(x86)}\NetSupport",
             "$env:APPDATA\NetSupport","$env:LOCALAPPDATA\client32.exe")
foreach ($p in $NSPaths) {
    if (Test-Path $p) { $Report += [pscustomobject]@{Type='NETSUPPORT_ARTIFACT'; Indicator=$p; Detail='Found on disk - verify legitimacy'} }
}
Get-Process client32 -ErrorAction SilentlyContinue | ForEach-Object {
    $Report += [pscustomobject]@{Type='NETSUPPORT_PROCESS'; Indicator='client32.exe'; Detail=$_.Path}
}

# 4. Suspicious LNK files with image double-extensions (last 30 days)
$LurePaths = @($env:USERPROFILE + '\Downloads', $env:USERPROFILE + '\Desktop', $env:TEMP)
foreach ($lp in $LurePaths) {
    Get-ChildItem $lp -Recurse -Include *.jpg.lnk,*.png.lnk,*.jpeg.lnk,*.pdf.lnk -ErrorAction SilentlyContinue |
      Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-30) } | ForEach-Object {
        $Report += [pscustomobject]@{Type='LNK_LURE'; Indicator=$_.Name; Detail=$_.FullName}
    }
}

# 5. Active connections to blockchain API endpoints
$BlockchainHosts = @('api.etherscan.io','toncenter.com','tonapi.io','mainnet.infura.io')
Get-NetTCPConnection -State Established | ForEach-Object {
    try {
        $resolved = (Resolve-DnsName $_.RemoteAddress -ErrorAction Stop).NameHost
        if ($BlockchainHosts | Where-Object { $resolved -like "*$_*" }) {
            $proc = Get-Process -Id $_.OwningProcess
            $Report += [pscustomobject]@{Type='BLOCKCHAIN_C2_CONN'; Indicator=$resolved; Detail="$($proc.Name) -> $($_.RemoteAddress):$($_.RemotePort)"}
        }
    } catch {}
}

# 6. Scheduled tasks with suspicious names/actions
Get-ScheduledTask | Where-Object {
    $_.TaskName -match 'ether|resolver|update.*svc|guest' -or
    ($_.Actions.Execute -match 'powershell|mshta|rundll32' -and $_.TaskPath -notlike '\Microsoft*')
} | ForEach-Object {
    $Report += [pscustomobject]@{Type='SCHED_TASK'; Indicator=$_.TaskName; Detail=$_.Actions.Execute}
}

if ($Report.Count -gt 0) {
    $Report | Format-Table -AutoSize
    $Report | Export-Csv "$env:TEMP\EtherRAT_Hunt_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation
    Write-Host "[!] $($Report.Count) findings - escalate to IR immediately" -ForegroundColor Red
} else {
    Write-Host "[+] No EtherRAT/TONResolver indicators found on $(hostname)" -ForegroundColor Green
}