MITRE ATT&CKsoftware (malware)
S9034 Tsundere Botnet
- Domain
- enterprise
- Platforms
- Linux, macOS, Windows
- Aliases
- DinDoor
- Version
- 1.0
- Created
- 2026-04-20
Description
Tsundere Botnet is a botnet first reported in mid-2025 that is delivered via MSI installer or a PowerShell script. It leverages Node.js and JavaScript for payload delivery and execution, and uses smart contracts on the blockchain to host command and control (C2) addresses. Tsundere Botnet is attributed to a likely Russian-speaking threat actor.
A variant named DinDoor has been linked to MuddyWater operations and uses the Deno runtime for execution rather than Node.js.
Related
Uses · MITRE ATT&CK (17)
- T1027.013 Encrypted/Encoded File sub-technique
- T1027.010 Command Obfuscation sub-technique
- T1614 System Location Discovery technique
- T1059.007 JavaScript sub-technique
- T1071.001 Web Protocols sub-technique
- T1102.001 Dead Drop Resolver sub-technique
- T1564.003 Hidden Window sub-technique
- T1195.001 Compromise Software Dependencies and Development Tools sub-technique
- T1059.001 PowerShell sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1218.007 Msiexec sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1480 Execution Guardrails technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1082 System Information Discovery technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- G0069 MuddyWater group
References
- https://research.checkpoint.com/2026/iranian-mois-actors-the-cyber-crime-connection/ Checkpoint_MOISCyberCrime_Mar2026
- https://ctrlaltintel.com/research/MuddyWater/ CAL_MuddyWater_Mar2026
- https://socradar.io/blog/iran-muddywater-dindoor-malware-us-networks/ SOCRadar_MuddyWaterDindoor_Mar2026
- https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/ SecureListUbiedo_Tsundere_Nov2025