TONResolver node.exe Persistence via HKCU Run Registry Key

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects unauthorized persistence established by the TONResolver RAT, where the node.exe process creates or modifies an autorun registry entry in HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The registry value points to an executable located within the user's AppData\Local\Nodejs directory, a common path utilized by the malware for persistence.