Tag: tsundere bot

2 Attack Reports | 0 Vulnerabilities

Attack reports

Can't stop, won't stop: TA584 innovates initial access

TA584, a prominent initial access broker targeting organizations globally, demonstrated significant changes in attack strategies throughout 2025. The actor expanded its global targeting, adopted ClickFix social engineering techniques, and began delivering new malware called Tsundere Bot. TA584's op…
xworm
social engineering
cobalt strike
cybercrime
dcrat
email campaigns
warmcookie
clickfix
initial access broker
malware delivery
xeno rat
ursnif
tsundere bot
2026-01-28
ldr4
Published: January 28, 2026
Downloadable IOCs: 7

The Tsundere botnet uses the Ethereum blockchain to infect its targets

The Tsundere botnet, discovered in mid-2025, is an active threat targeting Windows users. It utilizes the Ethereum blockchain to retrieve C2 addresses and employs Node.js for its operations. The botnet spreads through MSI installers and PowerShell scripts, often disguised as popular games. It uses …
powershell
javascript
node.js
botnet
msi
ethereum
websocket
2025-11-20
123 stealer
aes-256
tsundere bot
koneko
tsundere
Published: November 20, 2025
Downloadable IOCs: 21
Click here to see more Attack Reports