Loading malware…
Tsundere is a Node.js-based Windows botnet that uses blockchain-based command-and-control discovery. It is deployed through malicious Windows Installer packages that install a Node.js runtime and legitimate supporting libraries. The malware queries the Ethereum blockchain to obtain and validate a WebSocket command-and-control endpoint, enabling operators to rotate backend infrastructure without updating deployed implants. Tsundere receives and executes arbitrary JavaScript supplied by its command-and-control server, allowing flexible post-compromise actions on infected hosts. Variants and closely related activity have been reported in infrastructure and operations associated with MuddyWater; DinDoor has been assessed as a Tsundere variant. Attribution of the original Tsundere development remains unconfirmed, although reporting has noted possible Russian-speaking developer links.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“CastleRAT” refers specifically to the native PE component of the malware; ChainShell and the Deno-based “Tsundere” variants are separate TAG-150 platform components deployed alongside CastleRAT by the same operator.
“CastleRAT” refers specifically to the native PE component of the malware; ChainShell and the Deno-based “Tsundere” variants are separate TAG-150 platform components deployed alongside CastleRAT by the same operator.
During the engagement, TRU found on that server a malicious file with functionality to establish persistence and deploy the Tsundere botnet malware, which also integrates the “EtherHiding” C2 resolution logic.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
In these intrusions, the group used a previously unseen backdoor called DinDoor, which is a new variant of the MuddyWater-linked Tsundere botnet, according to Check Point.
Central to the operations is a PowerShell deployer ("reset.ps1") that deploys a previously undocumented JavaScript-based malware called ChainShell...
Central to the operations is a PowerShell deployer ("reset.ps1") that deploys a previously undocumented JavaScript-based malware called ChainShell, which then contacts a smart contract on the Ethereum blockchain to retrieve a C2 address and use it to fetch next-stage JavaScript code for execution on compromised hosts.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
Other indicator types observed in public reporting.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as another malware family reported to use Node.js, malicious installers, and blockchain-based C2 discovery.
Mentioned only for comparison as malware that uses blockchain infrastructure to help locate C2 servers.
Botnet malware noted here for integrating the EtherHiding C2 resolution logic and sharing extensive code commonalities with EtherRAT.
Botnet malware delivered by the same PowerShell loader and deployed alongside CastleRAT as part of TAG-150 platform components.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.