Tofsee

Tofsee, also known as Gheg, is a long-running modular Windows botnet malware family primarily associated with spam operations but capable of a broader range of criminal activity. Active since at least the late 2000s and widely observed from 2013 onward, it has been used in mass campaigns to build spambots and botnets, send large volumes of unsolicited email, conduct click fraud, proxy traffic, perform cryptocurrency mining, and download additional malware. Some reporting also attributes credential-stealing functionality to the family. Tofsee is commonly described as plugin-based, with a core component that maintains encrypted command-and-control communications, retrieves updated configuration data, and loads DLL-based modules in memory to extend functionality.

Its architecture typically consists of a loader and a core bot component. The loader has been observed masquerading as benign content, including social-media lures, and downloading both the core malware and a decoy file. The core module hides on the infected host, communicates with command-and-control servers over commonly allowed ports using custom encryption rather than standard TLS, and receives frequent configuration updates. Documented plugins support spam delivery, proxying, denial-of-service activity, sniffing, spreading, protective or anti-bot functions, and cryptocurrency mining. Analyses of more recent activity found active use of proxying and miner modules, with infected systems serving as backconnect proxies and participating in privacy-coin mining, while spam functionality remained available even when less prominent in observed telemetry.

Tofsee has been delivered through multiple infection vectors over time. Observed distribution methods include phishing and spearphishing emails with malicious attachments, social-network lures, exploit-kit delivery in earlier campaigns, and installation by third-party malware loaders such as PrivateLoader and HijackLoader. In email-borne campaigns, attachments have included obfuscated script downloaders that retrieve and execute the bot on Windows systems. Once installed, Tofsee has been observed establishing persistence through Windows services, Run-key autostart entries, scheduled or service-based mechanisms, and stored local configuration data. It also employs defense-evasion techniques including packing, code obfuscation, anti-analysis behavior, Windows Defender exclusions, firewall-rule modification, and process injection into legitimate Windows processes such as svchost.exe.

Operationally, infected hosts are used as part of a botnet for spam distribution, click-fraud traffic generation, proxy services, and mining. Spam-related configurations support templated email generation and direct-to-MX delivery, while proxy functionality has been used to relay HTTP(S), SOCKS, and spam-associated traffic. Tofsee has also been linked to broader cybercrime delivery ecosystems in which botnets and loaders are contracted to distribute downstream payloads. The malware has no consistently attributed single threat actor and is better understood as a commodity cybercrime malware family that has evolved through multiple phases while remaining active and periodically resurging in the threat landscape.