Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

Kaspersky Security Blog

Check Point Research

CVE Database V5

AlienVault OTX General

SecurityWeek

Threatpost

The Hacker News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

SANS ISC Handlers Diary

Reddit NetSec

Reddit InfoSec News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

The Tsundere botnet, discovered in mid-2025, is an active threat targeting Windows users. It utilizes the Ethereum blockchain to retrieve C2 addresses and employs Node.js for its operations. The botnet spreads through MSI installers and PowerShell scripts, often disguised as popular games. It uses AES-256 CBC encryption for communication and can execute dynamic JavaScript code received from the C2 server. The botnet features a marketplace and control panel, allowing users to create and sell customized bots. Attributed to a Russian-speaking actor known as 'koneko', Tsundere is linked to the 123 Stealer and represents an evolution of previous attacks. Its use of smart contracts for C2 infrastructure enhances its resilience, making it a significant emerging threat.

The Tsundere botnet, identified in mid-2025, represents an advanced malware campaign targeting Windows systems. It uniquely leverages the Ethereum blockchain to store and retrieve its command and control (C2) server addresses via smart contracts, which significantly enhances its resilience and evasion capabilities by decentralizing its infrastructure. The botnet operates using Node.js, allowing it to execute dynamic JavaScript code received from its C2 servers, enabling flexible and adaptive malicious operations. Infection vectors include MSI installers and PowerShell scripts, often disguised as popular games to entice users into executing them. Communications between infected hosts and C2 servers are encrypted using AES-256 in CBC mode, complicating network detection efforts. The botnet is linked to a Russian-speaking threat actor known as 'koneko' and is associated with the 123 Stealer malware, indicating a lineage of credential and data theft capabilities. Additionally, Tsundere features a marketplace and control panel that facilitate the creation, customization, and sale of bot variants, suggesting a commoditized malware-as-a-service model. The use of Ethereum smart contracts for C2 infrastructure is a novel technique that complicates takedown attempts by law enforcement and security teams, as blockchain data is immutable and globally distributed. The botnet employs multiple tactics and techniques mapped to MITRE ATT&CK, including obfuscation, credential access, persistence, and command execution. While no known exploits are currently reported in the wild, the botnet's capabilities and infrastructure indicate a significant emerging threat to Windows environments worldwide.

Detailed information about The Tsundere botnet uses the Ethereum blockchain to infect its targets. Get real-time updates, technical details, and mitigation stra

The Tsundere botnet uses the Ethereum blockchain to infect its targets - Live Threat Intelligence - Threat Radar | OffSeq.com

The Tsundere botnet uses the Ethereum blockchain to infect its targets

Title	Severity	Type	Source	Date

Threats Tagged '123 stealer'

Stop chasing alerts. Route them.

Filter Threats

Threats Tagged '123 stealer'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility