Loading threat actor…
Tsundere is an emerging botnet and associated operator cluster focused on compromising Windows systems and executing arbitrary JavaScript on infected hosts. The operation has been linked to a Russian-speaking threat actor, with reporting also associating the activity with the name koneko. Tsundere has been described as abusing Node.js and the Ethereum blockchain for command-and-control resilience, including use of a smart-contract-based mechanism to store and rotate C2 information. The botnet is delivered through a fake MSI installer that deploys Node.js together with legitimate libraries and then establishes a WebSocket-based control channel after validating blockchain-derived server details. Once active, it can receive and execute attacker-supplied JavaScript, giving operators flexible post-compromise control. Observed tradecraft also includes use of a dropper associated with the botnet and overlap with other criminal infrastructure, including shared infrastructure with 123 Stealer. Tsundere demonstrates capabilities spanning initial access, persistence, defense evasion, post-exploitation, and exfiltration. A known variant, DinDoor, has used Rclone to access cloud storage for data movement. The botnet’s use of legitimate runtimes, public blockchain infrastructure, and common administrative tooling helps blend malicious activity with normal software and network behavior. Available reporting supports characterization of Tsundere as a cybercrime-oriented botnet rather than a ransomware or state intelligence actor.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Russian-operated cybercrime botnet/C2 marketplace infrastructure offering bot access, payload generation, SOCKS proxying, and blockchain-based C2 rotation; its tooling was found deployed alongside MuddyWater infrastructure.
Tsundere is described as an emerging botnet abusing blockchain and Node.js components.
Tsundere is a newly emergent botnet targeting Windows systems, capable of executing arbitrary JavaScript code. It is distributed via a fake MSI installer that delivers Node.js and legitimate libraries. The botnet uses the Ethereum blockchain to retrieve WebSocket C2 server details, enabling infrastructure rotation and dynamic code execution.
Its DinDoor variant used Rclone to access a Wasabi server for cloud interaction/exfiltration.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.