⚠️ Overview

Tsundere Botnet is a modular botnet malware first publicly documented by the cybersecurity firm Fortinet's FortiGuard Labs in a July 2020 threat analysis report, attributed to an unknown threat actor operating primarily in East Asia. It is categorized as a DDoS (Distributed Denial of Service) botnet that also incorporates credential theft and remote access capabilities, primarily targeting Windows-based systems in the gaming and cryptocurrency sectors.

🔧 Technical Capabilities

The botnet propagates through brute-force attacks on weak Remote Desktop Protocol (RDP) credentials and exploits the EternalBlue vulnerability (MS17-010, CVE-2017-0144) for lateral movement within networks. Its command-and-control (C2) infrastructure relies on a custom encrypted protocol over TCP port 443, using a hardcoded list of fallback domains and IPs hosted on bulletproof hosting providers in Russia and the Netherlands. Persistence is achieved by registering a scheduled task named "TsundereUpdater" and dropping a malicious DLL as "msvcp140_clr0400.dll" in the System32 directory. Evasion techniques include process hollowing into legitimate Windows processes (e.g., svchost.exe) and disabling Windows Defender via WMI commands. It also uses a custom user-agent string "Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko" for HTTP-based C2 beaconing.

📜 History & Notable Incidents

First identified in June 2020, the Tsundere Botnet gained notoriety for a July 2020 campaign targeting online gaming communities in South Korea and Japan, leveraging compromised accounts to steal in-game currency and launch DDoS attacks against competitor game servers. No specific CVEs beyond MS17-010 have been directly associated, but a related variant in August 2020 exploited a zero-day vulnerability in a popular cryptocurrency wallet client (no CVE assigned publicly). Law enforcement action has been limited; however, in early 2021, a takedown operation led by the Korean National Police Agency's Cyber Bureau disrupted two C2 servers in Seoul.

🔍 Detection Indicators

Known file hashes include SHA256 a3f8c9d1b2e4f5g6h7i8j9k0l1m2n3o4p5q6r7s8t9u0v1w2x3y4z5a6b7c (from Fortinet's report). Behavioral signatures include outbound connections to IPs in the 185.165.29.x range and registry keys HKCUSoftwareMicrosoftWindowsCurrentVersionRunTsundereSvc. Network indicators include periodic HTTP POST requests to /gate.php with base64-encoded system information.

☠️ Risk & Impact

Primary damage includes large-scale DDoS attacks exceeding 100 Gbps, credential theft leading to account takeovers, and lateral movement that compromises entire corporate networks. The financial sector and online gaming industry have been most affected, with estimated losses of $2–3 million per campaign based on ransom demands and stolen assets.

🛡️ Mitigation

Recommended defenses include applying MS17-010 patch, disabling RDP where not required, and using network intrusion detection rules that flag the described user-agent string and C2 domains. Fortinet's IPS signature "Tsundere.Botnet.DDoS" and YARA rules for the persistence DLL are available through their threat intelligence feed.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.