Loading story…
A rapidly expanding botnet known as Tsundere is actively targeting Windows users by leveraging fake installers disguised as popular video games such as Valorant, Counter-Strike 2, and Rainbow Six Siege X. The botnet, first observed in mid-2025, executes arbitrary JavaScript code retrieved from a command-and-control (C2) server, with the infrastructure utilizing the Ethereum blockchain for C2 retrieval. Infection vectors include the use of Remote Monitoring and Management (RMM) tools to download malicious MSI installers from compromised websites, as well as PowerShell scripts that deploy Node.js and additional dependencies on victim systems. The malware achieves persistence by installing legitimate Node.js libraries and modifying registry keys to ensure execution upon login.
Kaspersky researchers have identified that the Tsundere botnet's implants are distributed in two main formats: MSI installers and PowerShell scripts. The MSI installer method installs Node.js and the pm2 package to maintain persistence, while the PowerShell variant creates registry entries for the same purpose. The campaign appears to target users seeking pirated versions of popular games, exploiting their interest to propagate the malware. The botnet's infrastructure is actively maintained and poses an ongoing threat, with no definitive evidence yet on all propagation methods, but clear indications of sophisticated social engineering and technical persistence mechanisms.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
Kaspersky GReAT publicly disclosed technical details on Tsundere, describing its use of Node.js, AES-256-CBC decryption, pm2 and Run-key persistence, encrypted WebSocket communications, and Ethereum-based C2 discovery. The report also noted links to the 123 Stealer ecosystem, a possible actor handle "koneko," and the presence of a combined marketplace/control panel called "Tsundere Netto" v2.4.4.
During its mid-2025 activity, Tsundere infections were observed masquerading as popular game installers, with artifacts referencing titles such as Valorant, Rainbow Six, and CS2. In at least one case, an RMM tool downloaded a malicious MSI named "pdf.msi" from a compromised website.
Kaspersky reported that the Windows-focused Node.js botnet dubbed Tsundere was discovered around mid-2025 and had been active since then. The malware was seen spreading through fake MSI installers and PowerShell-based infection chains.
In October 2024, a supply-chain campaign published hundreds of malicious npm typosquatting packages. Kaspersky later assessed Tsundere as linked to this earlier activity.
The infrastructure later used by the Tsundere botnet included an Ethereum smart contract created in September 2024 to store or retrieve WebSocket command-and-control server details, enabling resilient C2 rotation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcescworld.com
Open sourcethehackernews.com
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Proofpoint reported that **TA584**, a high-volume **initial access broker (IAB)** tracked since 2020, significantly increased operational tempo in 2025 and introduced multiple attack-chain changes, including expanded global targeting, adoption of **ClickFix** social engineering, and delivery of a newer malware family dubbed **Tsundere Bot**. Proofpoint assessed that TA584’s rapid campaign iteration and shifting infrastructure/lures reduce the effectiveness of static detections, and noted overlap with a group it tracks as **Storm-0900**. TA584’s prevalent infection chain uses phishing emails sent from **hundreds of compromised, aged accounts** and delivered via services such as **SendGrid** and **Amazon SES**, with per-target URLs, **geofencing/IP filtering**, and redirect chains that can involve third-party **traffic distribution systems (TDS)** like *Keitaro*. Victims who pass filtering are led through a CAPTCHA page to a ClickFix page that instructs them to run a **PowerShell** command, which retrieves an obfuscated script and loads **XWorm** or **Tsundere Bot** in memory; Proofpoint assessed with high confidence that **Tsundere Bot infections could lead to ransomware**, given its observed capabilities for information gathering, exfiltration, lateral movement, and payload delivery. Kaspersky previously documented Tsundere Bot and linked it to a Russian-speaking operator associated with **123 Stealer**, and Proofpoint’s reporting ties its use directly to TA584’s access-brokering activity.
Jun 29, 2026
Microsoft Threat Intelligence reported an active malware campaign targeting gamers by distributing **trojanized gaming utilities** through browsers and chat platforms, leading victims to execute a multi-stage downloader that ultimately installs a **Java-based remote access trojan (RAT)**. The infection chain was observed staging a portable Java runtime and launching a malicious JAR (`jd-gui.jar`), while using **PowerShell** and living-off-the-land binaries such as `cmstp.exe` to reduce detection. The activity includes defense evasion by deleting the initial downloader and adding **Microsoft Defender exclusions**, and persistence via a scheduled task and a startup script named `world.vbs`; the RAT then beacons to **`79.110.49[.]15`** for C2, enabling data theft and follow-on payload delivery. Reporting also noted the campaign’s use of gaming-adjacent filenames to increase execution likelihood (e.g., `Xeno.exe`, `RobloxPlayerBeta.exe`) and emphasized that the final payload functions as a **loader/runner/downloader/RAT** rather than a single-purpose stealer, increasing the risk of secondary malware deployment. Separately, one report highlighted the emergence of *Steaelite*, a Windows RAT advertised on criminal forums with claimed “FUD” capabilities and an integrated panel combining data theft and ransomware features, underscoring broader commoditization of multi-function RAT ecosystems even when not directly tied to the specific trojanized-gaming-tools intrusion chain.
Jun 29, 2026
Researchers reported a stealthy malware campaign targeting enterprise administrators, DevOps engineers, and security analysts by impersonating trusted administrative and developer utilities in malicious MSI installers. The operation used SEO poisoning to push victims toward spoofed tool listings and a dual-stage GitHub distribution chain in which benign-looking facade repositories redirected users to secondary repositories hosting the real payload, enabling operators to rotate malware quickly while preserving search credibility. At least 44 GitHub facade repositories spoofing IT tools were observed between December 2025 and early April 2026. The payload, **EtherRAT**, is a multi-stage Node.js remote access trojan that downloads Node.js at runtime, establishes registry-based persistence, and executes through `conhost.exe` with a `--headless` argument to reduce visibility. Researchers said the malware uses layered `AES-256-CBC` encryption and retrieves its live command-and-control endpoint through public Ethereum RPC services and a hardcoded smart contract, effectively using the blockchain as a dead-drop resolver that complicates domain and IP takedowns. Reporting linked the campaign to prior EtherRAT and EtherHiding activity and said the tradecraft overlaps with malware previously associated with **Lazarus Group**, while also noting code similarities to **Tsundere**, a malware family tied in other research to **MuddyWater (APT34)**.
Jun 29, 2026