TONResolver RAT: TON Blockchain Dead Drop C2 Resolution via Non-Browser Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•4

Detects the TONResolver RAT attempting to resolve its Command and Control (C2) server address by querying TON blockchain API endpoints. The rule monitors network connections and DNS queries made by non-standard processes to known TON API infrastructure, specifically tracking potential dead-drop resolver behavior where smart contract data is used to obtain malicious infrastructure addresses.