Tsundere Botnet

ATP Sandbox Adv. Heuristics

Stats

First seen: March 2026
Last seen: October 2026

MITRE ATT&CK techniques

17 techniques across 7 tactics.

TA0001 Initial Access

T1195Supply Chain Compromise
- T1195.001Compromise Software Dependencies and Development Tools

TA0002 Execution

T1059Command and Scripting Interpreter
- T1059.007JavaScript
- T1059.001PowerShell

TA0003 Persistence

T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.013Encrypted/Encoded File
- T1027.010Command Obfuscation
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1140Deobfuscate/Decode Files or Information
T1218System Binary Proxy Execution
- T1218.007Msiexec
T1480Execution Guardrails
T1564Hide Artifacts
- T1564.003Hidden Window

TA0007 Discovery

T1082System Information Discovery
T1614System Location Discovery

TA0011 Command and Control

T1071Application Layer Protocol
- T1071.001Web Protocols
T1102Web Service
- T1102.001Dead Drop Resolver
T1105Ingress Tool Transfer

TA0010 Exfiltration

T1567Exfiltration Over Web Service
- T1567.002Exfiltration to Cloud Storage

Associated groups

G0069MuddyWater

Alert name variants

Alert Name	Engine
Script-PowerShell.Backdoor.Dindoor	ATP Sandbox Adv. Heuristics
Script-PowerShell.Trojan.Dindoor	ATP Sandbox Adv. Heuristics
Win32.Trojan.Dindoor	ATP Sandbox Adv. Heuristics

Related families

GlassWorm Metamorfo PlugX PureCrypter Ursnif