Hackers Turn TON Blockchain Into a Resilient C2 Directory for Node.js Backdoor

The attack uses malicious Windows shortcut files, PowerShell, a legitimate Node.js runtime, and the TON blockchain to maintain a flexible command-and-control (C2) system. The campaign shows how attackers are increasingly combining trusted services, legitimate software, and blockchain-based infrastructure to complicate detection and takedown efforts. Blockchain-hosted C2 mechanisms can act as resilient “dead-drop” resolvers because operators can change instructions without…

Diamond Model