Tsundere Botnet
Tsundere Botnet is a JavaScript-based malware family and remote access tool first documented by Kaspersky in mid-2025 and publicly described in late 2025. It is associated in reporting with Russian-speaking actor "koneko," and multiple sources later linked related activity and infrastructure to the Iranian MOIS-linked espionage group MuddyWater (also tracked as Seedworm, Static Kitten, Mango Sandstorm, Earth Vetala, and TA450). The malware relies on trusted scripting runtimes rather than conventional compiled implants, with observed Node.js-based payloads and a Deno-based variant named DinDoor.
Reported capabilities include execution of obfuscated JavaScript payloads, host fingerprinting, command-and-control communications, retrieval of additional payloads, and use as a backdoor/RAT. DinDoor, described as a variant of Tsundere Botnet, abuses the legitimate Deno runtime and MSI installers to evade detection, can execute JavaScript entirely in memory, binds a localhost TCP listener as a mutex, fingerprints victims using username, hostname, memory, and OS release, and communicates with C2 over HTTP. Tsundere Botnet infrastructure has also been described as using Ethereum smart contracts as a dead-drop resolver for resilient C2 discovery; reported smart contract addresses include 0x2B77671cfEE4907776a95abbb9681eee598c102E and 0xa1b40044EBc2794f207D45143Bd82a1B86156c6b, with getString() used to resolve C2 servers. Historical WebSocket/C2 infrastructure mentioned in the reporting includes 185.236.25.119, 193.17.183.126, and the domain serialmenot[.]com.
Observed delivery and execution chains include heavily obfuscated PowerShell loaders and MSI-based installers delivered via phishing emails or malicious drive-by downloads. One reported Tsundere dropper was reset.ps1, a 2.2 MB obfuscated PowerShell script found on MuddyWater infrastructure. DinDoor samples were reported as downloading deno.exe from dl.deno[.]land, then executing base64-decoded JavaScript. Specific sample hashes mentioned for DinDoor are 7b793c54a927da36649eb62b9481d5bcf1e9220035d95bbfb85f44a6cc9541ae (migcredit.pdf.msi) and 2a09bbb3d1ddb729ea7591f197b5955453aa3769c6fb98a5ef60c6e4b7df23a5 (Installer_v1.21.66.msi).
The malware has been discussed in the context of both cybercrime and state-linked operations. Reporting describes overlap with MuddyWater tradecraft, including use from exposed MuddyWater infrastructure and overlap with Wasabi/Rclone-based access and exfiltration workflows. DinDoor activity was linked by Broadcom to Seedworm/MuddyWater targeting organizations in the United States, while broader MuddyWater reporting placed related operations against targets in Israel, Jordan, Egypt, the UAE, Portugal, and the United States. Additional reporting notes infrastructure overlap with multi-tenant or shared criminal platforms, including serialmenot[.]com and behavioral overlap with CastleLoader/FakeSet ecosystems. A headline also described Tsundere Botnet as using Node.js malware, Ethereum smart-contract-based "unkillable" C2, and operating a cybercrime marketplace, with DDoS-related tagging.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The file reset.ps1 on MuddyWater's server is not MuddyWater malware. It is a Tsundere Botnet dropper -- a 2.2 MB heavily obfuscated PowerShell script attributed by Kaspersky GReAT to Russian-speaking threat actor "koneko."
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Within the server, we identified that MuddyWater had staged a PowerShell loader, reset.ps1. The PowerShell loader will lead to execution of obfuscated Node.js payloads that appear similar to Tsundere Botnet.
The file reset.ps1 on MuddyWater's server is not MuddyWater malware. It is a Tsundere Botnet dropper -- a 2.2 MB heavily obfuscated PowerShell script attributed by Kaspersky GReAT to Russian-speaking threat actor "koneko."
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
Initial Access
2 techniques
Initial Access
Execution
3 techniques
Execution
Within the server, we identified that MuddyWater had staged a PowerShell loader, reset.ps1... The PowerShell loader will lead to execution of obfuscated Node.js payloads.
Persistence
2 techniques
Persistence
Privilege Escalation
1 technique
Privilege Escalation
Stealth
3 techniques
Stealth
The PowerShell loader will lead to execution of obfuscated Node.js payloads... Embedded within the PowerShell loader are AES-CBC/PKCS7 encrypted blobs.
Defense Impairment
1 technique
Defense Impairment
Discovery
1 technique
Discovery
Command and Control
5 techniques
Command and Control
Tsundere Botnet Uncovered: Node.js Malware Uses Ethereum Smart Contract for Unkillable C2
PersianC2 used standard HTTP polling... This bot communicates over WebSocket to retrieve commands.
MITRE ATT&CK Mapping Technique ID Name Evidence T1102 Web Service Ethereum blockchain for C2 resolution
IOCs tracked for this family
69 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Botnet family that DinDoor is described as a variant of.
A JavaScript-based remote access tool/botnet using Node.js, described as the broader malware family or umbrella under which DinDoor is tracked as a variant.
Botnet used by MuddyWater as part of MOIS-linked cyber operations.
Botnet leveraging Node.js/JavaScript for execution on compromised hosts; observed to switch to Deno-based execution in some cases (variant dubbed DinDoor).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.