Tsundere Botnet
- ID
- S9034
- Type
- Malware
- Associated names
- DinDoor
- Platforms
- Linux, macOS, Windows
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Tsundere Botnet is a botnet first reported in mid-2025 that is delivered via MSI installer or a PowerShell script. It leverages Node.js and JavaScript for payload delivery and execution, and uses smart contracts on the blockchain to host command and control (C2) addresses. Tsundere Botnet is attributed to a likely Russian-speaking threat actor.
A variant named DinDoor has been linked to MuddyWater operations and uses the Deno runtime for execution rather than Node.js.[1][2][3][4]
Techniques used (17)
- T1027.010 Command Obfuscation
- T1027.013 Encrypted/Encoded File
- T1036.005 Match Legitimate Resource Name or Location
- T1059.001 PowerShell
- T1059.007 JavaScript
- T1071.001 Web Protocols
- T1082 System Information Discovery
- T1102.001 Dead Drop Resolver
- T1105 Ingress Tool Transfer
- T1140 Deobfuscate/Decode Files or Information
- T1195.001 Compromise Software Dependencies and Development Tools
- T1218.007 Msiexec
- T1480 Execution Guardrails
- T1547.001 Registry Run Keys / Startup Folder
- T1564.003 Hidden Window
- T1567.002 Exfiltration to Cloud Storage
- T1614 System Location Discovery