TONResolver RAT: node.exe JS Execution from AppData/Temp with .shop/.bond/.sbs/.cfd C2 DNS

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•0

Detects instances where node.exe is launched from common user-mode applications (like browsers or shells) and executes a JavaScript file from temporary or user application data directories, followed by a DNS request to domains associated with high-risk TLDs (shop, bond, sbs, cfd). This behavior is characteristic of certain remote access trojans (RATs) that utilize node.js for secondary payloads.