Last seven days
- First activity
- Sep 24, 2026
- Last activity
- Sep 25, 2026
- Feed role
- C2
- Host form
- 2 IP / 0 hostnames
Tsundere
Tsundere is a Node.js-based Windows botnet that uses blockchain-based command-and-control discovery.
Profile source: Mallory opens in a new tabTsundere
Family profile
Tsundere is a Node.js-based Windows botnet that uses blockchain-based command-and-control discovery. It is deployed through malicious Windows Installer packages that install a Node.js runtime and legitimate supporting libraries. The malware queries the Ethereum blockchain to obtain and validate a WebSocket command-and-control endpoint, enabling operators to rotate backend infrastructure without updating deployed implants. Tsundere receives and executes arbitrary JavaScript supplied by its command-and-control server, allowing flexible post-compromise actions on infected hosts. Variants and closely related activity have been reported in infrastructure and operations associated with MuddyWater; DinDoor has been assessed as a Tsundere variant. Attribution of the original Tsundere development remains unconfirmed, although reporting has noted possible Russian-speaking developer links.
Capabilities
- Post Exploitation
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
1 Sep 24
1 Sep 25
Observed infrastructure
Leading locations
- DE2
Leading providers
- NEKOBYTE INTERNATIONAL LIMITED2
Infrastructure traits
- Hosting 2
Reported operators
Threat actors
3 named in public reporting“CastleRAT” refers specifically to the native PE component of the malware; ChainShell and the Deno-based “Tsundere” variants are separate TAG-150 platform components deployed alongside CastleRAT by the same operator.
“CastleRAT” refers specifically to the native PE component of the malware; ChainShell and the Deno-based “Tsundere” variants are separate TAG-150 platform components deployed alongside CastleRAT by the same operator.
During the engagement, TRU found on that server a malicious file with functionality to establish persistence and deploy the Tsundere botnet malware, which also integrates the “EtherHiding” C2 resolution logic.
MITRE ATT&CK
Tsundere in ATT&CK
11 distinct techniquesTechniques
11 techniques T1059.007 JavaScript T1059 Command and Scripting Interpreter T1204.002 Malicious File T1027 Obfuscated Files or Information T1568 Dynamic Resolution T1547.001 Registry Run Keys / Startup Folder T1219 Remote Access Tools T1036 Masquerading T1608.006 SEO Poisoning T1059.001 PowerShell T1105 Ingress Tool Transfer
