Initial access hackers switch to Tsundere Bot for ransomware attacks

Proofpoint observed TA584 shifting to use Tsundere Bot alongside XWorm in expanded, large-scale email-based initial access campaigns: attackers send emails from aged compromised accounts via SendGrid/SES, use TDS redirects, CAPTCHA/ClickFix landing pages and PowerShell loaders to execute obfuscated scripts that load in-memory payloads. Tsundere Bot is a Node.js-based malware with Ethereum-derived C2, data collection and proxying capabilities, and its use by TA584 is assessed as likely to enable ransomware and other post-compromise activity.