The Cyber Nexus: Iranian Group ‘Muddy Water’ Caught Deploying Russian ‘Tsundere’ Botnet via EtherHiding

eSentire’s Threat Response Unit reports that Iranian state-aligned group Muddy Water has deployed the Tsundere botnet — a likely Russian-developed Malware-as-a-Service — which leverages an "EtherHiding" technique storing C2 addresses in Ethereum smart contracts to evade takedown; the malware includes CIS-country avoidance checks and JavaScript obfuscation similar to North Korean APTs, indicating high sophistication and national-security implications.