Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows
These articles are AI-generated summaries. Please check the original sources for full details.
Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows
The Tsundere botnet, active since mid-2025, targets Windows users with the capability to execute arbitrary JavaScript code from a command-and-control (C2) server. Researchers observed the botnet utilizing game-themed lures like Valorant and Counter-Strike 2 to distribute malicious MSI and PowerShell installers.
Why This Matters
Traditional botnet infrastructure relies on static C2 servers, creating single points of failure and making takedown easier. Tsundere’s use of the Ethereum blockchain for C2 rotation significantly increases resilience, making disruption more complex and costly; the smart contract alone has seen 26 transactions. This highlights a shift toward leveraging decentralized technologies to improve botnet persistence.
Key Insights
- Ethereum C2: The botnet utilizes a smart contract created on September 23, 2024, to dynamically retrieve C2 server addresses.
- Node.js Dependency: The malware relies on Node.js for execution, installing it via both MSI and PowerShell installers.
- RMM Tool Abuse: Initial infection vectors include compromised sites delivering malicious MSI installers via legitimate Remote Monitoring and Management (RMM) tools.
Practical Applications
- Use Case: Threat actors are utilizing Tsundere to build and rent botnets through a dedicated marketplace, offering proxy services and malicious capabilities.
- Pitfall: Relying on static indicators of compromise (IOCs) is ineffective against botnets employing dynamic C2 infrastructure like Tsundere, requiring behavioral analysis.
References:
Continue reading
Next article
Allen Institute for AI (AI2) Introduces Olmo 3: Open Source 7B/32B LLMs with 65K Context Window
Related Content
JackFix Campaign Leverages Fake Windows Updates to Deploy Multiple Stealers
The JackFix campaign utilizes deceptive fake Windows update pop-ups on adult websites to deliver multi-stage PowerShell malware, resulting in potential data theft and system compromise.
JS#SMUGGLER Campaign Deploys NetSupport RAT via Compromised Websites
Researchers detail JS#SMUGGLER, a multi-stage web attack leveraging JavaScript, HTA, and PowerShell, resulting in NetSupport RAT deployment.
Silver Fox Targets Indian Users With ValleyRAT Malware via Tax-Themed Phishing
Silver Fox is deploying ValleyRAT, a modular Windows RAT, through India income tax phishing emails, resulting in potential credential theft and system compromise.