Trend Micro researchers have identified a remote-access trojan, dubbed TONResolver, that leverages the TON blockchain in its operations and is being used against targets in Japan's hotel industry.

The malware's designation reflects its use of the TON blockchain — the distributed ledger originally developed alongside the Telegram messaging platform — as part of its command infrastructure. Security researchers at Trend Micro, who documented the campaign, named the RAT for this blockchain dependency.

A remote-access trojan gives attackers unauthorized control over an infected machine. Once embedded, the operator can exfiltrate files, capture credentials, and stage further intrusion — a risk profile that carries direct costs for hotel operators holding guest reservation data, payment information, and property-management system credentials on connected networks.

The targeting of Japan's hotel sector places the campaign within a broader pattern of hospitality-focused cyber intrusions, where attackers pursue reservation platforms and guest payment flows. Hotels run front-desk terminals, booking engines, and back-office systems on networks that often mix franchise and corporate-managed properties, complicating patching and endpoint control.

Using a public blockchain as command-and-control infrastructure offers attackers resilience: takedowns of conventional servers do not easily disrupt infrastructure distributed across a decentralized ledger. Trend Micro's analysis frames TONResolver as an example of this technique spreading beyond its earlier confines.

For hospitality IT and security teams, the finding argues for segmenting property networks, enforcing least-privilege access on reservation and payment systems, and monitoring outbound traffic for unusual blockchain-related connections. Operators in Japan — and chains with Japanese properties in their portfolios — are the immediate audience for the indicator data typically published alongside such research.

Trend Micro indicates continued tracking of the campaign as it develops.