TONResolver RAT C2 DNS Lookup via TON Blockchain API (tonapi.io)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects anomalous outbound proxy requests to TON blockchain API endpoints (tonapi.io or toncenter.com) attempting to call the 'get_domain' method. This behavior is associated with the TONResolver RAT, which uses a specific, hardcoded smart contract address to dynamically resolve its C2 server hostname, effectively bypassing static domain-based security filters.