Tag: 123 stealer

2 Attack Reports | 0 Vulnerabilities

Attack reports

EtherRAT Targeting Windows Disguised as a Game Mod Installer

A Windows variant of EtherRAT, a JavaScript-based malware, has been discovered disguised as game mod installers. The malware uses MSI files to create and execute obfuscated scripts that decrypt and run the main payload. EtherRAT retrieves its Command and Control (C2) server addresses dynamically th…
obfuscation
windows
persistence
c2 communication
msi
ethereum
smart contract
123 stealer
CVE-2025-55182
etherrat
2026-01-21
game mod
tsundere botnet
Published: January 21, 2026
Downloadable IOCs: 12

The Tsundere botnet uses the Ethereum blockchain to infect its targets

The Tsundere botnet, discovered in mid-2025, is an active threat targeting Windows users. It utilizes the Ethereum blockchain to retrieve C2 addresses and employs Node.js for its operations. The botnet spreads through MSI installers and PowerShell scripts, often disguised as popular games. It uses …
powershell
javascript
node.js
botnet
msi
ethereum
websocket
2025-11-20
123 stealer
aes-256
tsundere bot
koneko
tsundere
Published: November 20, 2025
Downloadable IOCs: 21
Click here to see more Attack Reports