To address the issue of power fluctuations caused by a high proportion of renewable energy resources, it is necessary to introduce flexible load resources to provide regulating capacity and maintain the power balance of the electrical system. Thermostatically controlled loads (TCLs) constitute a significant proportion of the total electricity consumption and have great potential for regulation, warranting further research. In terms of TCL control, distributed control systems with good scalability and flexibility have been widely applied. However, distributed control systems are at a higher risk of network attacks such as False Data Injection (FDI), which can lead to failures in TCL power regulation and threaten the economic security of grid operators and end-users. This paper proposes a secure distributed control method for TCLs that can with stand bounded FDI attacks. Firstly, a distributed control architecture for TCLs is constructed to provide regulating capacity for the power system. Then, a mathematical model of bounded time-varying FDI attacks is established, and the adverse effects of bounded FDI attacks on TCL power regulation are quantitatively analyzed. Based on this, a resilient distributed controller that can withstand bounded FDI attacks is designed, ensuring the provision of sufficient regulating capacity for the grid even under attack. Moreover, the convergence of the proposed controller is proven using Lyapunov theory. Finally, the effectiveness of the proposed resilient distributed controller is verified through simulation experiments.