In mid-2025, researchers uncovered a previously undocumented botnet that we now track as Tsundere. This threat represents a clear evolution of activity first observed in October 2024, when a threat actor distributed malicious Node.js packages through the Node Package Manager (npm). Those earlier campaigns relied on typosquatting—naming malicious packages almost identically to legitimate, popular libraries—to compromise developers and end users alike.
Our analysis shows strong technical continuity between the 2024 supply-chain attack and Tsundere. Code similarities, the same command-and-control (C2) retrieval technique, and reuse of cryptocurrency wallets all point to a single actor refining their tooling after an initial disruption. Unlike the short-lived npm campaign, Tsundere is an active and expanding botnet, currently targeting Windows systems.
Background: From npm Typosquatting to Botnet Operations
The October 2024 campaign centered on malicious npm packages masquerading as well-known libraries such as Puppeteer, Bignum.js, and multiple cryptocurrency-related modules. In total, 287 malicious packages were identified. These packages delivered payloads to Windows, Linux, and macOS systems before being detected and removed. The threat actor subsequently abandoned this delivery method.
By July 2025, however, the same actor resurfaced with a more mature and resilient approach: a full-fledged botnet, complete with a control panel, marketplace, and blockchain-backed C2 infrastructure. We named this new threat Tsundere, after the branding used in its C2 panel.
Initial Infection Vectors
At present, there is no definitive single infection vector for Tsundere. In one confirmed case, the implant was deployed via a Remote Monitoring and Management (RMM) tool, which downloaded an installer named pdf.msi from a compromised website.
Other samples suggest a different lure: pirated or fake installers for popular Windows games. Filenames observed in the wild include references to well-known first-person shooters such as Valorant, CS2, and Rainbow Six. This naming strategy appears designed to appeal to piracy communities, where users are more likely to disable security controls.
Malware Implants
The Tsundere botnet currently supports two primary implant formats:
- An MSI installer
- A PowerShell-based infector
Both formats are automatically generated by the botnet’s C2 panel, allowing operators to rapidly create customized builds.
MSI Installer
The MSI installer is typically disguised as a legitimate installer for games or popular software. During our research, detection rates for these samples were notably low.
Internally, the installer bundles both legitimate Node.js components and malicious JavaScript artifacts. These files are deployed to the user’s %LOCALAPPDATA%\nodejs directory. While node.exe, npm.cmd, and npx.cmd are legitimate, they are installed alongside obfuscated loader and configuration files.
A custom action in the MSI executes a Base64-encoded PowerShell command, which in turn launches Node.js in a hidden window. This Node.js process spawns a detached child process that executes the malicious loader script, remaining invisible to the user.
Loader Script and Environment Setup
The loader script’s role is to decrypt and deploy the core Tsundere components. Although heavily obfuscated, it can be deobfuscated using publicly available tools. Once executed, the loader:
- Locates encrypted script and configuration files.
- Decrypts them using AES-256-CBC with a build-specific key and initialization vector.
- Writes the decrypted artifacts to disk under new filenames.
The decrypted configuration file defines a complete directory structure, including a fully populated node_modules tree. This allows the malware to deploy npm and all required dependencies without relying on an existing Node.js environment.
Once unpacked, the malware installs three key npm packages locally:
- ws – WebSocket networking
- ethers – Ethereum blockchain interaction
- pm2 – Node.js process manager
The use of pm2 is particularly important: it ensures the bot remains running and establishes persistence by configuring automatic restarts and registry entries.
PowerShell Infector
The PowerShell-based infector is more compact but achieves the same end result. Instead of embedding Node.js, it downloads a legitimate Node.js ZIP archive directly from the official website and extracts it locally.
Two large hexadecimal-encoded variables embedded in the script are decrypted (again using AES-256-CBC) to produce:
- The bot script
- A persistence script
A malicious package.json file is written to disk, listing dependencies such as ws and ethers. The persistence script is executed first, followed by the bot itself.
Persistence is achieved via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. The script overwrites itself with a Base64-decoded variant designed to relaunch the bot at every user login.
Tsundere Bot Internals
C2 Address Retrieval via Blockchain
One of Tsundere’s most notable features is its use of the Ethereum blockchain to store and rotate C2 addresses. Instead of hardcoding server locations, the bot queries a specific smart contract controlled by the threat actor.
The contract exposes a function that updates a string stored in a state variable. This string—encoded in hexadecimal—contains the WebSocket C2 address. Because blockchain transactions are immutable, this method provides a resilient and tamper-resistant reference point.
To retrieve the C2 address, the bot iterates through a list of public Ethereum RPC endpoints, queries recent transactions associated with the contract and wallet, and extracts the stored string. The bot validates that the result begins with ws:// or wss:// before using it.
Before connecting, the bot checks the system locale and avoids execution on systems located in CIS countries, a common trait among Russian-language malware.
Communication Protocol
Once connected to the WebSocket C2 server, Tsundere establishes an encrypted communication channel:
- The bot connects to the server.
- An AES key is exchanged.
- The bot confirms receipt.
- The server sends an IV, enabling encrypted traffic.
- The bot transmits system metadata (OS, MAC address, GPU, memory).
- The server acknowledges the connection.
- Encrypted communication continues, with ping/pong keep-alive messages every minute.
These periodic messages allow the C2 panel to track active bots in real time. Notably, no additional authentication is required, meaning a fake client could theoretically connect.
Bot Functionality
Tsundere is intentionally minimalist but highly flexible. The C2 server can send arbitrary JavaScript code to connected bots. When a message with a specific identifier is received, the bot evaluates the code as a function, executes it, and returns the result—encrypted—to the server.
This design allows operators to dynamically extend functionality without redeploying the malware, adapting the botnet for tasks ranging from data theft to proxying or further payload delivery.
Infrastructure and Control Panel
At the time of analysis, Tsundere communicated with multiple WebSocket servers, rotating addresses through blockchain updates. The botnet typically maintained between 90 and 115 active bots concurrently.
The ecosystem is managed through a combined control panel and marketplace, branded as Tsundere Netto. Notably, registration is open: any user can create an account and access the interface. Key features include:
- Bot dashboards
- Build systems (MSI or PowerShell)
- A marketplace for selling bot-based services
- Integrated Monero wallet functionality
- SOCKS proxy capabilities using infected hosts
Each build is associated with a unique identifier, embedded into the implant and linked to the user who generated it.
Attribution
Text strings within the implants strongly suggest a Russian-speaking author. Infrastructure overlap and panel similarities further link Tsundere to another known malware family, 123 Stealer, a C++-based information stealer sold on underground markets.
Both threats share hosting infrastructure, and open-source intelligence connects them to a Russian-speaking actor known as koneko, previously active on dark web forums. Koneko advertised expertise in Node.js malware and distributed multiple tools using MSI and PowerShell infection chains—consistent with Tsundere’s design.
Conclusion
Tsundere represents a clear escalation from opportunistic supply-chain attacks to a structured, service-oriented botnet. By combining Node.js-based implants, flexible loaders, and blockchain-hosted C2 addresses, the threat actor has built a resilient and adaptable platform.
The reuse of infrastructure and tooling across multiple malware families suggests ongoing development rather than a one-off campaign. Given its active growth and modular design, Tsundere should be closely monitored, as it is likely to evolve further and integrate additional malicious capabilities in the near future.
Indicators of Compromise (IoCs)
File Hashes
235A93C7A4B79135E4D3C220F9313421
760B026EDFE2546798CDC136D0A33834
7E70530BE2BFFCFADEC74DE6DC282357
5CC5381A1B4AC275D221ECC57B85F7C3
AD885646DAEE05159902F32499713008
A7ED440BB7114FAD21ABFA2D4E3790A0
7CF2FD60B6368FBAC5517787AB798EA2
E64527A9FF2CAF0C2D90E2238262B59A
31231FD3F3A88A27B37EC9A23E92EBBC
FFBDE4340FC156089F968A3BD5AA7A57
E7AF0705BA1EE2B6FBF5E619C3B2747E
BFD7642671A5788722D74D62D8647DF9
8D504BA5A434F392CC05EBE0ED42B586
87CE512032A5D1422399566ECE5E24CF
B06845C9586DCC27EDBE387EAAE8853F
DB06453806DACAFDC7135F3B0DEA4A8F
File Paths
%APPDATA%\Local\NodeJS
Domains and IPs
ws://185.28.119[.]179:1234ws://196.251.72[.]192:1234ws://103.246.145[.]201:1234ws://193.24.123[.]68:3011ws://62.60.226[.]179:3001
