Tsundere represents a significant shift in botnet tactics, leveraging the power of legitimate Node.js packages and blockchain technology to distribute malware across multiple operating systems.

First identified around mid-2025 by Kaspersky GReAT researchers, this botnet demonstrates the evolving sophistication of supply chain attacks.

The threat originates from activity first observed in October 2024, where attackers created 287 malicious npm packages using typosquatting—mimicking the names of popular libraries like Puppeteer and Bignum.js to deceive developers into installation.

The infection vector has evolved considerably since then. Tsundere spreads through multiple pathways, including Remote Monitoring and Management tools and disguised game installers that capitalize on piracy communities.

Samples discovered in the wild bear names like “valorant,” “cs2,” and “r6x,” specifically targeting first-person shooter enthusiasts.

This approach proves highly effective at evading traditional security awareness since users expect these applications anyway.

The botnet particularly threatens Windows users, though the initial campaign exposed systems across Windows, Linux, and macOS platforms when it operated through npm package deployment.

The infrastructure behind Tsundere reveals a sophisticated understanding of modern attack methods. Rather than relying on traditional centralized command-and-control infrastructure, the botnet utilizes Ethereum blockchain smart contracts to store and retrieve C2 addresses.

This approach adds resilience by making servers difficult to take down through conventional means. The threat actor, identified as koneko—a Russian-speaking operative—operates a professional marketplace where other cybercriminals can purchase botnet services or deploy their own functionality.

Securelist security analysts identified the malware after discovering connections between the current campaign and earlier supply chain attacks.

Their investigation revealed that the threat actor has since resurfaced with enhanced capabilities, launching Tsundere as an evolution of previous malware efforts.

The panel supports both MSI installer and PowerShell script delivery mechanisms, giving attackers flexibility in deployment strategies across different network environments and defenses.

How Tsundere Maintains Persistence Through Node.js Abuse

The infection mechanism begins when an MSI installer or PowerShell script executes on the victim’s system, dropping legitimate Node.js runtime files into AppData alongside malicious JavaScript.

The setup uses a hidden PowerShell command that spawns a Node.js process executing obfuscated loader code.

This loader script decrypts the main bot using AES-256-CBC encryption before establishing the botnet environment. The bot automatically installs three critical npm packages: ws for WebSocket communication, ethers for Ethereum blockchain interaction, and pm2 for process persistence.

The pm2 package plays a crucial role in maintaining presence on compromised machines. It creates registry entries that ensure the bot restarts automatically whenever a user logs in, achieving effective persistence.

The bot then queries Ethereum blockchain nodes through public RPC providers, retrieving the current C2 server address from a smart contract variable.

This clever approach means defenders cannot simply block a known IP address—the attackers rotate C2 infrastructure at will through blockchain transactions, rendering traditional IP-based blocking ineffective.

Once connected, the bot establishes encrypted communication and awaits commands from operators, which arrive as dynamic JavaScript code for execution.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Tsundere Botnet Abusing Popular Node.js and Cryptocurrency Packages to Attack Windows, Linux, and macOS Users appeared first on Cyber Security News.

A new banking malware called Sturnus has emerged as a significant threat to mobile users across Europe.

Security researchers have discovered that this sophisticated Android trojan can capture encrypted messages from popular messaging apps like WhatsApp, Telegram, and Signal by accessing content directly from the device screen after decryption.

The malware’s ability to monitor these communications marks a serious advancement in mobile banking threats, combining credential theft with extensive remote access capabilities.

The malware operates by harvesting banking credentials through convincing fake login screens that perfectly replicate legitimate banking applications.

What makes Sturnus particularly dangerous is its capacity to provide attackers with full device takeover, allowing them to observe all user activity without physical interaction.

Attackers can inject text messages, intercept communications, and even black out the device screen while conducting fraudulent transactions in the background, leaving victims completely unaware of the theft occurring on their compromised devices.

Threat Fabric security analysts identified Sturnus as a privately operated trojan currently in its early testing phase, with targeted campaigns already configured against financial institutions across Southern and Central Europe.

Although the malware remains in limited deployment, researchers emphasize that Sturnus is fully functional and more advanced than several established malware families in certain aspects, particularly regarding its communication protocol and device support capabilities.

This combination of sophisticated features and targeted geographic focus suggests attackers are refining their tools before launching broader operations.

The current threat landscape indicates that Sturnus.A operates with region-specific targeting, using tailored overlay templates designed for Southern and Central European victims.

The malware’s operators demonstrate clear focus on compromising secure messaging platforms, testing the trojan’s ability to capture sensitive communications across different environments.

The relatively few samples detected so far, combined with short intermittent campaigns rather than sustained large-scale activity, indicate the operation remains in evaluation and tuning phases.

Understanding the Communication Protocol

The malware’s complex communication structure inspired its name, drawing parallels to the Sturnus vulgaris bird, whose rapid and irregular chatter jumps between whistles, clicks, and imitations.

Sturnus mirrors this chaotic pattern through its layered mix of plaintext, RSA, and AES communications that switch unpredictably between simple and complex messages.

The malware establishes a connection with its command-and-control server using both WebSocket (WSS) and HTTP channels, transmitting a combination of encrypted and plaintext data primarily over WebSocket connections.

The technical handshake begins with an HTTP POST request where the malware registers the device using a placeholder payload. The server responds with a UUID client identifier and an RSA public key.

The malware then generates a 256-bit AES key locally, encrypts it using RSA/ECB/OAEPWithSHA-1AndMGF1Padding, and transmits the encrypted key back while storing the plaintext AES key on the device in Base64 format.

Once key exchange completes, all subsequent communication receives protection through AES/CBC/PKCS5Padding with a 256-bit encryption key.

The trojan generates fresh 16-byte initialization vectors for each message, prepends them to encrypted payloads, and wraps results in custom binary protocols containing message type headers, message length data, and client UUIDs.

This sophisticated encryption scheme demonstrates the developers’ expertise in secure communications while maintaining malicious functionality.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Sturnus Banking Malware Steals Communications from Signal and WhatsApp, Gaining Full Control of The Device appeared first on Cyber Security News.

The U.S. Attorney’s Office, Southern District of New York, has announced the sentencing of Keonne Rodriguez and William Lonergan Hill, co-founders of Samourai Wallet, a cryptocurrency mixing application designed specifically to hide illegal financial transactions.

Rodriguez, who served as the Chief Executive Officer, received a five-year prison sentence on November 6, 2025, while Hill, the Chief Technology Officer, was sentenced to four years on November 19, 2025.

Their criminal enterprise facilitated the laundering of over $237 million in illicit funds through their mobile application platform.

Starting around 2015, Rodriguez and Hill developed Samourai with the explicit purpose of concealing criminal proceeds.

The application’s architecture centered on two core services built specifically to obstruct law enforcement investigations and prevent financial tracing.

Over 80,000 Bitcoin, valued at more than $2 billion at the time, flowed through their services, generating approximately $6 million in fees for the operators.

The U.S. Attorney’s Office, Southern District of New York security analysts identified that the criminal proceeds originated from multiple sources including drug trafficking, darknet marketplaces, cyber-intrusions, frauds, sanctioned jurisdictions, murder-for-hire schemes, and child pornography operations.

How Samourai’s Technical Infrastructure Enabled Money Laundering

The mixing service functioned through two primary obfuscation mechanisms. The first, known as “Whirlpool,” coordinated Bitcoin exchanges among user groups, effectively scrambling the blockchain record and making fund origins virtually untraceable to law enforcement and cryptocurrency exchanges.

The second service, called “Ricochet,” inserted unnecessary intermediate transactions referred to as “hops” between sending and receiving addresses, significantly complicating the ability of monitoring entities to establish connections between transfers and criminal activities.

Beyond the technical infrastructure, Rodriguez and Hill actively promoted their service to criminal communities.

Hill marketed Samourai on Dread, a darknet forum, explicitly recommending Whirlpool as the optimal method to “clean dirty BTC.”

Similarly, Rodriguez personally encouraged social media platform hackers via Twitter to route their stolen proceeds into Samourai’s Whirlpool service in July 2020, demonstrating direct knowledge and intentional facilitation of criminal activity.

The sentencing reflects the serious consequences of operating money laundering services, regardless of the technology employed, signaling law enforcement’s commitment to pursuing cryptocurrency-based financial crime.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post Samourai Wallet Cryptocurrency Mixing Founders Jailed for Laundering Over $237 Million appeared first on Cyber Security News.

A new wave of ransomware attacks is targeting cloud storage environments, specifically focusing on Amazon Simple Storage Service (S3) buckets that contain critical business data.

Unlike traditional ransomware that encrypts files using malicious software, these attacks exploit weak access controls and configuration mistakes in cloud environments to lock organizations out of their own data.

As more businesses move their operations to the cloud, attackers are adapting their methods, shifting away from on-premises systems to cloud-based resources where valuable information is stored.

These attacks can result in complete data loss, operational disruptions, and significant financial damage if organizations lack proper backup and recovery systems.

The threat actors behind these campaigns gain unauthorized access through stolen credentials, leaked access keys found in public code repositories, or compromised AWS accounts with excessive permissions.

Once inside, they identify vulnerable S3 buckets by checking for specific weaknesses such as disabled versioning, missing object lock protection, and improper write permissions.

The attackers then proceed to encrypt data using various encryption techniques, delete original files, or exfiltrate sensitive information before demanding ransom payments.

What makes these attacks particularly dangerous is their ability to use native cloud features to conduct malicious activities while remaining hidden from traditional security monitoring tools.

Trend Micro security researchers identified five distinct ransomware variants that specifically target S3 storage environments, each using different attack methods to achieve data encryption or deletion.

These variants range from using customer-managed encryption keys with scheduled deletion timelines to leveraging server-side encryption with customer-provided keys that AWS cannot recover.

The researchers documented both observed attack techniques used in real-world incidents and potential future attack vectors that organizations should prepare to defend against.

Their analysis provides detailed technical breakdowns of how each variant operates and what security measures can prevent these attacks.

Attack Mechanism and Technical Execution

The Server-Side Encryption with Customer-Provided Keys (SSE-C) variant represents one of the most dangerous attack methods because it creates permanently unrecoverable encrypted data.

In this approach, threat actors first gain write-level access to victim S3 buckets through compromised credentials or leaked IAM roles from public GitHub repositories.

After identifying target buckets without proper protections, attackers initiate encryption by providing a locally stored AES-256 encryption key through specific HTTP request headers or AWS command-line tools.

The critical aspect of this technique is that AWS uses the attacker’s encryption key to secure the data but never stores the actual key in its systems.

AWS only logs a Hash-based Message Authentication Code (HMAC) of the encryption key in CloudTrail logs, which cannot be reversed or used to decrypt the protected data.

This means neither the victim organization nor AWS support teams can recover the encrypted information once the attacker completes the encryption process.

After encrypting all target files, the attackers deposit ransom notes in the affected buckets, typically naming them “ransom-note.txt” or similar variations, which contain instructions for payment and communication.

The entire attack can be executed rapidly, and because the encryption key exists only on the attacker’s systems, victims face a permanent lockout unless they pay the ransom or have separate backup copies stored securely.

Organizations can protect against this variant by implementing specific policy controls that block SSE-C encryption requests at the bucket level or through organization-wide resource control policies.

Security teams should monitor CloudTrail logs for unusual SSE-C encryption activities and enforce policies that deny PutObject requests containing customer-provided encryption algorithm headers, effectively eliminating this attack vector from their cloud environments.

Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.

The post New Ransomware Variants Targeting Amazon S3 Services Leveraging Misconfigurations and Access Controls appeared first on Cyber Security News.