Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows

Cybersecurity researchers have warned of an actively expanding Windows botnet named Tsundere, which researchers say relies on game-themed lures to propagate and uses an Ethereum-based C2 to fetch JavaScript code. Active since mid-2025, the malware retrieves arbitrary JavaScript from a C2 server and can be dropped via a legitimate Remote Monitoring and Management tool used to download an MSI installer from a compromised site, according to Kaspersky.

The threat actor’s artefacts include Valorant, r6x (Rainbow Six Siege X), and cs2 (Counter-Strike 2), suggesting distribution through pirated game lures, with the fake MSI installer installing Node.js and a loader script to decrypt and run the main payload. The botnet’s persistence is aided by the pm2 utility, and its C2 uses WebSocket connections to fetch code, while a PowerShell path mirrors these actions and creates a registry entry to ensure login persistence.

The Ethereum contract behind the C2 rotates infrastructure via a smart contract created on 23 September 2024, which has seen 26 transactions to date, according to Checkmarx, Phylum, and Socket’s analysis referenced by The Hacker News.