aol.pm

Tsundere Botnet

Software · ATTACK:enterprise:S9034

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:S9034",
  "title": "Tsundere Botnet",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S9034",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "malware--18f5f8c6-bba5-4aba-93e7-3539fe565883",
  "external_id": "S9034",
  "domain": "enterprise",
  "created": "2026-04-20T22:24:44.870Z",
  "modified": "2026-05-12T15:12:00.733Z",
  "version": "1.0",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "DinDoor"
    },
    {
      "source_name": "Checkpoint_MOISCyberCrime_Mar2026",
      "url": "https://research.checkpoint.com/2026/iranian-mois-actors-the-cyber-crime-connection/"
    },
    {
      "source_name": "CAL_MuddyWater_Mar2026",
      "url": "https://ctrlaltintel.com/research/MuddyWater/"
    },
    {
      "source_name": "SOCRadar_MuddyWaterDindoor_Mar2026",
      "url": "https://socradar.io/blog/iran-muddywater-dindoor-malware-us-networks/"
    },
    {
      "source_name": "SecureListUbiedo_Tsundere_Nov2025",
      "url": "https://securelist.com/tsundere-node-js-botnet-uses-ethereum-blockchain/117979/"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1567.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08763e14-92e8-422e-b71e-bd1b0949fcc7

Checkpoint_MOISCyberCrime_Mar2026

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1480

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0e7e92e6-2163-44cb-b8c5-420577aeada7

SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1d8442ee-ca18-4c12-a784-3094c85ae5e7

CAL_MuddyWater_Mar2026 · SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1614

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--288697f9-74a7-4b63-a92c-2c0fa13ef138

SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1195.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35b777b1-2c2e-4f00-bb08-843bc3e42d69

SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--54a96733-eb51-43ba-a080-3b4adbcbc915

SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:G0069 → uses → ATTACK:enterprise:S9034

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5fecf480-e8ab-401d-b3a9-46c490673431

Checkpoint_MOISCyberCrime_Mar2026

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1102.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6c51ae5d-0e55-41df-97ae-091f57c118ba

CAL_MuddyWater_Mar2026 · SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7118797d-8bb1-4404-8f00-d02113c7dd7d

CAL_MuddyWater_Mar2026 · SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1027.013

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--85c7f253-c343-4601-8e35-1923d3fdb1fe

CAL_MuddyWater_Mar2026

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--87a6c355-530c-4c68-a435-f83565000e95

SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab0632b1-c417-43aa-91ad-b0773f0fd1ce

CAL_MuddyWater_Mar2026 · SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b145e291-ce58-4174-b0e2-e0c5bc51e151

SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c97ef137-79d7-4e87-ba15-f719724eb15b

SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d1e98b60-3705-4617-bcec-5b03219d8949

SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1218.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d868ae80-0dcb-420c-ad6e-e0974f26fea1

SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--da225cfe-1959-4faa-afef-b5c7a6555bba

CAL_MuddyWater_Mar2026 · SecureListUbiedo_Tsundere_Nov2025

ATTACK:enterprise:S9034 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e5bd61a9-44d3-4d69-b0b5-a05c8c0d3cac

SecureListUbiedo_Tsundere_Nov2025

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.