Loading malware…
Tofsee, also known as Gheg, is a long-running modular Windows botnet malware family primarily associated with large-scale spam operations but also used for click fraud, cryptocurrency mining, proxying, credential theft, and delivery of additional malware. Active since at least the late 2000s and widely observed since the 2010s, it has been used in mass campaigns without a consistently attributed single threat actor and has repeatedly resurfaced through different criminal distribution ecosystems.
Tofsee uses a loader-and-core architecture with DLL-based plug-ins that are fetched from command-and-control infrastructure and executed in memory. Its configuration system supports frequent updates, including command-and-control server lists, spam templates, string variables, and plug-in deployment. Documented plug-ins and modules support spam delivery, proxying, mining, sniffing, spreading, denial-of-service activity, and protective or anti-bot functions. In more recent observations, active use has emphasized web-traffic proxying and cryptocurrency mining, while older and parallel reporting also documents spam botnet behavior, click fraud, and theft of login and email credentials.
On infected hosts, Tofsee has been observed establishing persistence through Windows services, Run-key autostart, and stored local configuration data. It employs defense-evasion measures including packing, obfuscation, anti-analysis behavior, firewall-rule modification, process injection, and execution of malicious functionality inside legitimate Windows processes such as svchost.exe. Communications with command-and-control servers use custom encrypted protocols rather than standard TLS, and the malware can continuously retrieve updated configuration data and additional plug-ins after initial compromise.
Delivery has varied over time. Tofsee has been distributed through phishing campaigns using malicious ZIP attachments containing obfuscated JavaScript downloaders, through social-network lures disguised as image content, and via third-party malware loaders and pay-per-install services including PrivateLoader and HijackLoader. Earlier reporting also tied Tofsee delivery to exploit-kit and malvertising activity. Infected systems are commonly incorporated into spam botnets and may also be repurposed as proxy nodes or mining hosts.
The malware has had a global victim footprint, with reporting noting broad worldwide distribution and periodic concentration in countries such as India and Brazil. It has also appeared in infrastructure and telemetry linked to broader cybercrime ecosystems, including spam-delivery chains supporting other malware operations. Tofsee remains notable for its longevity, modularity, and adaptability across multiple monetization models within commodity cybercrime.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
Talos published a blog post discussing how the RIG exploit kit was delivering this malware to compromised endpoints using malvertising.
Around 3% of the requests were HTTP POST with the URI ending in '.php' and, in many cases, starting with '/wp-', to random websites that appear legitimate... These indicators lead us to believe that these (apparently) legitimate websites have been likely compromised to be used to distribute spam.
At the first step, we see how it launches a copy of itself to SysWow64 which it then moves to a temporary folder, the commands used, launched by cmd.exe are the following
In addition, we can see, that it enters it in exclusions in registry key, being the path with random name the place where it was previously self-dropped
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> 12
While all the above processes are being launched, we have the other binary in a temporary path performing other actions, such as injecting an svchost... Once in this phase, you have the Tofsee functionalities inside a legitimate process
<HKLM>\SYSTEM\CONTROLSET001\SERVICES\<random, matching '[A-Z0-9]{8}'> 12
After this, it creates a service using sc.exe... The command used, launched by sc.exe is as follows: "C:\Windows\System32\sc.exe" create <Name of file dropped> ... start= auto DisplayName= "wifi support"
The code in javascript attachment is obfuscated in an attempt to make analysis more difficult.
The samples are packed but can be easily unpacked... Threat Actors make use of packers when distributing their malware as they remain an effective way to evade detection.
Usually, the file comes from a social network and disguises itself as an interesting picture.
While all the above processes are being launched, we have the other binary in a temporary path performing other actions, such as injecting an svchost... Once in this phase, you have the Tofsee functionalities inside a legitimate process
It also deletes the initial binary using a batch file that is temporarily stored inside the %TEMP% directory.
Although the core module connects to the C&C server through ports 443, 995 or 465, the connections are not standard SSL. The streams between them are encrypted by a customized encryption routine.
the malware downloads two types of resources (updates) from its command-and-control (C2) server: configurations, and plugins to extend its functionality.
Additionally, HTTP GET requests are generated periodically as the malware attempts to simulate clicking on ads as part of its click fraud routine.
Once infected, systems will begin connecting to various SMTP relays and sending spam email messages.
Bitsight has noticed Tofsee engaging in web traffic proxying... and also performing cryptocurrency mining.
191 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
19 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Botnet referenced as part of the commodity malware pipeline and observed dropping follow-up payloads.
An additional malware family embedded in samples delivered through the PrivateLoader distribution chain.
Botnet used to originate/distribute spam emails in the described campaigns; historically propagated via the PrivateLoader loader.
An older malware family known for spamming and botnet activities, experiencing a resurgence in 2025.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.