TONResolver RAT AES-256-CBC Encrypted WebSocket C2 from node.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects outbound WebSocket connections on common web ports initiated by node.exe that do not originate from standard Node.js installation directories. This behavior is characteristic of the TONResolver RAT, which utilizes AES-256-CBC encrypted communication over WebSockets with a 20-second keepalive interval.