Tsundere Botnet

Executive Summary

Tsundere Botnet is a cross‑platform malware family that delivers Node.js or Deno‑based JavaScript payloads via MSI installers or PowerShell scripts. It uniquely employs smart contract smart contracts for resilient command‑and‑control, making it harder to block with traditional network filtering. The bot is linked to Russian‑speaking actors and has been observed in MuddyWater operations, suggesting a focus on credential theft and DDoS capabilities.

Tsundere Botnet, also known as DinDoor in certain variants, surfaced publicly in mid‑2025 and has since been observed targeting Windows, macOS, and Linux environments. The botnet’s distribution vector is primarily a MSI installer or PowerShell script that embeds a lightweight Node.js runtime for executing JavaScript payloads. In contrast, the DinDoor variant leverages the newer Deno runtimes instead of traditional Node.js to avoid baseline detection on Windows platforms. A distinctive feature of Tsundere Botnet is its use of blockchain smart contracts as the foundation for command‑and‑control (C&C) infrastructure. By hosting C2 addresses within immutable contract data, adversaries create a highly resilient communication channel that is difficult to sinkhole or block through traffic analysis alone. The bot’s payload logic is written in JavaScript/TypeScript and dynamically fetched from these smart contracts, allowing frequent updates without touching the local file system. Attribution points toward a Russian‑speaking threat actor, with evidence linking DinDoor specifically to MuddyWater operations. While public reports do not enumerate all secondary actions (e.g., ransomware or DDoS), industry analysts have identified typical botnet behaviors such as credential harvesting and participation in distributed denial‑of‑service attacks once the command layer is established. The combination of cross‑platform operability, script‑based delivery, and blockchain‑hosted C&C provides Tsundere Botnet with a sophisticated evasion surface that challenges conventional signature‑based detection. Security teams must therefore combine endpoint behavioral monitoring with network traffic analysis focused on anomalous connections to public blockchain nodes and the execution of unfamiliar JavaScript runtimes.

Key Capabilities

• Deploys via MSI installer or PowerShell script on Windows, macOS, and Linux
• Installs/executes lightweight Node.js or Deno runtime for JavaScript payloads
• Uses blockchain smart contracts to host command‑and‑control addresses and distribute updates
• Implements dynamic code fetching and execution from the chain
• Supports cross‑platform persistence through scheduled tasks or service creation
• Exhibits high resilience against sinkhole due to immutable C2 storage

ATT&CK Techniques

Recommended Actions

• Implement application whitelisting to block unknown MSI installers and PowerShell scripts
• Detect and monitor for suspicious Node.js/Deno process executions on endpoints
• Inspect outbound traffic for connections to public blockchain nodes (e.g., Ethereum RPC endpoints)
• Block access to known malicious domains associated with Tsundere Botnet via DNS filtering
• Deploy behavioral EDR solutions that flag dynamic JavaScript execution patterns
• Enforce least privilege and restrict scripts from writing executable binaries

Suggested Tags