Hackers Use Negative Hotel Reviews to Spread Malware That Hides C2 on Blockchain
Cofense says hotel staff are phished with fake complaints that deliver EtherRAT and TONResolver using blockchain C2.
62
Malware
EtherRAT
- Mentions · 7d0
- Mentions · 30d2
- All mentions3
- First seenSep 3, 2026
- Last mentioned22d ago
Timeline
3 articles · newest firstHackers Target Hotels With Fake Guest Complaints to Deploy Blockchain-Based RAT Malware
Hotel staff are phished with fake guest complaints that deliver EtherRAT and TONResolver using blockchain C2 lookups.
60
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
Symantec reports multiple threat actors, including KongTuke, abusing the trusted signed Node.js runtime and blockchain C2 (EtherHiding) to deliver backdoors in targeted attacks.
62
Appears with
- Node.jsproduct · 2
- Booking.comorganization · 2
- Cofenseorganization · 2
- TONResolvermalware · 2
- AdaptixC2product · 1
- Symantecorganization · 1
- Node.jsvendor · 1
- Windowsproduct · 1
- Ethereumproduct · 1
- EtherRATproduct · 1
- GateKeepermalware · 1
- Broadcomorganization · 1
- Zscalervendor · 1
- Zscalerorganization · 1
- Woodgnatthreat actor · 1
- C2Looperproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.