TONResolver RAT node.exe WebSocket C2 with AES-256-CBC Encrypted Channel

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule monitors for node.exe processes running from the AppData directory initiating multiple network connections to non-private (external) IP addresses over common web ports (80, 443, 8080, 8443). Running Node.js from user-writable temporary directories can be an indicator of malicious activity or the execution of unauthorized web applications attempting command and control communication.