MalwarePublished 20 Nov 2025Updated 20 Dec 2025

The Tsundere botnet uses the Ethereum blockchain to infect its targets

Source AlienVault OTX General

Description

The Tsundere botnet, discovered in mid-2025, is an active threat targeting Windows users. It utilizes the Ethereum blockchain to retrieve C2 addresses and employs Node.js for its operations. The botnet spreads through MSI installers and PowerShell scripts, often disguised as popular games. It uses AES-256 CBC encryption for communication and can execute dynamic JavaScript code received from the C2 server. The botnet features a marketplace and control panel, allowing users to create and sell customized bots. Attributed to a Russian-speaking actor known as 'koneko', Tsundere is linked to the 123 Stealer and represents an evolution of previous attacks. Its use of smart contracts for C2 infrastructure enhances its resilience, making it a significant emerging threat.

Impact

For European organizations, the Tsundere botnet poses substantial risks including unauthorized access to sensitive data, credential theft, and potential lateral movement within networks. The use of encrypted communications and dynamic code execution complicates detection and response efforts, increasing the likelihood of prolonged undetected presence. The decentralized C2 infrastructure via the Ethereum blockchain makes traditional takedown strategies ineffective, potentially allowing sustained operations. Organizations in sectors with high-value data or critical infrastructure could face data breaches, operational disruptions, and reputational damage. The botnet's distribution through gaming-related installers may particularly impact enterprises with employees or customers engaging in gaming activities, increasing infection vectors. Additionally, the commoditization of the botnet through its marketplace lowers the barrier for less skilled attackers to launch customized campaigns, potentially increasing attack volume and diversity. Overall, the threat could lead to increased incident response costs, regulatory scrutiny under GDPR for data breaches, and potential financial losses due to fraud or ransomware deployment by secondary actors leveraging the botnet.

Defensive guidance

1. Implement strict application whitelisting to prevent execution of unauthorized MSI installers and PowerShell scripts, especially those originating from untrusted sources or disguised as games. 2. Enforce PowerShell execution policies to restrict script execution and enable logging and monitoring of PowerShell activities to detect suspicious behavior. 3. Deploy endpoint detection and response (EDR) solutions capable of identifying Node.js-based malware and monitoring for dynamic JavaScript execution. 4. Monitor network traffic for unusual connections to Ethereum blockchain nodes or smart contract interactions, using threat intelligence to identify known malicious addresses. 5. Educate users about the risks of downloading and executing software from unverified sources, particularly gaming-related content. 6. Regularly update and patch Windows systems and security tools to reduce exploitation of known vulnerabilities. 7. Utilize threat hunting to identify indicators of compromise related to Tsundere, including encrypted communications and PowerShell/MSI execution patterns. 8. Collaborate with blockchain security experts to understand and monitor smart contract activities linked to the botnet. 9. Prepare incident response plans that consider the botnet's decentralized C2 infrastructure and encrypted communications to enable rapid containment and eradication.

Indicators of compromise

IP addresses 5

103.246.145.201
196.251.72.192
185.28.119.179
193.24.123.68
62.60.226.179

Hashes 48

235a93c7a4b79135e4d3c220f9313421
31231fd3f3a88a27b37ec9a23e92ebbc
5cc5381a1b4ac275d221ecc57b85f7c3
760b026edfe2546798cdc136d0a33834
7cf2fd60b6368fbac5517787ab798ea2
7e70530be2bffcfadec74de6dc282357
87ce512032a5d1422399566ece5e24cf
8d504ba5a434f392cc05ebe0ed42b586
a7ed440bb7114fad21abfa2d4e3790a0
ad885646daee05159902f32499713008

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 21 Nov 2025, 09:53 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

IP addresses 5

Hashes 48

Community reviews

Related threats