TONResolver RAT C2 Resolution via TON Blockchain API (tonapi.io)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

This rule detects network connections or DNS queries related to the TON blockchain ecosystem, specifically targeting domains and API endpoints associated with TON network infrastructure. These communication patterns may indicate interaction with cryptocurrency-related services or potential malware utilizing TON-based infrastructure for command and control or data exfiltration.