Emergence of Tsundere Botnet Exploiting Node.js and Cryptocurrency Packages

First seen 23 Nov 2025, 03:35 UTC • Cybersecuritynews

•0% similarity •29

Ask AI about this cluster

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Tsundere botnet, identified by Kaspersky GReAT in mid-2025, targets Windows, Linux, and macOS users by leveraging legitimate Node.js packages and blockchain technology. Initially observed in October 2024, it utilizes a malicious MSI installer and exploits the Ethereum blockchain for command-and-control operations.

ThreatCluster AI How this analysis works

Attack Flow

9 entities, 13 inferred relationships (STIX 2.1).

Technique (3)

Botnet
Malware
Supply Chain Attack

Malware (1)

Tsundere Botnet

Affected Platform (4)

Blockchain
Linux
MacOS
Windows

Tool (1)

Node.js

Relationships

Botnet targets Blockchain
Botnet targets Linux
Botnet targets MacOS
Botnet targets Windows
Malware targets Blockchain
Malware targets Linux
Malware targets MacOS
Malware targets Windows
Supply Chain Attack targets Blockchain
Supply Chain Attack targets Linux
Supply Chain Attack targets MacOS
Supply Chain Attack targets Windows
Tsundere Botnet related to Node.js

Community

Browse all →

Tracked Entities in This Story

Tsundere Botnet Blockchain Linux MacOS Windows

Emergence of Tsundere Botnet Exploiting Node.js and Cryptocurrency Packages

Ask AI about this cluster

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Community

Continue Reading

Tracked Entities in This Story