TONResolver is a malware family reported to use lookups on the TON blockchain to find its command-and-control (C2) infrastructure. Instead of hardcoding a fixed server address, the malware queries public blockchain data for a live location to contact. This is a form of dead-drop resolution, where an external data source acts as the pointer to the next stage of communication.
This matters because blockchain-based lookup can make malware harder to block and takedown. Defenders cannot rely only on a static IP or domain, since the operator may update the on-chain data to move C2 rapidly. In real investigations, unusual outbound traffic to blockchain-related services from systems that do not normally use them can be a useful hunting signal. Combined with phishing activity or suspicious executables, it may indicate an attempt to resolve hidden C2 rather than normal business traffic.