TA584 Abuses ClickFix Social Engineering in New Tsundere Bot Malware Campaign

TA584 represents one of the most prolific initial access brokers (IABs) currently operating in the cybercriminal ecosystem.

Since its first detection by Proofpoint researchers in November 2020, this sophisticated threat actor has demonstrated remarkable operational adaptability while maintaining consistent targeting patterns.

The group functions as an IAB, specializing in compromising organizational networks to sell access to ransomware operators and other cybercriminals.

Throughout 2025, TA584 exhibited significant tactical evolution, tripling its monthly campaign volume from March to December while simultaneously expanding geographic targeting and adopting advanced social engineering techniques.

The actor’s operational tempo accelerated dramatically throughout 2025, shifting from predictable, long-lived campaign patterns to rapid iteration cycles.

Individual campaigns now operate for hours to days rather than weeks or months, with TA584 launching overlapping operations using distinct lure themes, branding, and infrastructure.

This high-velocity approach represents a strategic adaptation to modern defensive capabilities, where continuous innovation outpaces static detection mechanisms.

TA584 overlaps with a group tracked by Microsoft Threat Intelligence as Storm-0900, indicating coordination or shared infrastructure within the broader Russian-speaking cybercriminal ecosystem.

Attribution evidence includes Russian-language code comments, Commonwealth of Independent States (CIS) country execution checks in malware code, and connections to Russian underground markets.

Social Engineering Tactics

TA584 employs sophisticated impersonation strategies targeting multiple organizational verticals.

In early campaigns, TA584 also delivered macro-enabled Excel documents (tracked as EtterSilent) directly after the filtering checks that, if macros were enabled, would lead to malware installation. 

The actor most frequently impersonates healthcare organizations, including hospitals and care facilities, followed by government agencies.

Additional impersonations span recruitment firms such as Michael Page and Adecco, business services including Better Business Bureau and Companies House, and recognized brands like PayPal, OSHA, Medicare, OneDrive, and YourCostSolutions.

Campaign themes observed throughout 2025 include debt collection notices, event invitations, tax obligations, medical test results, healthcare benefits notifications, parking tickets, recruiting correspondence, and business complaints.

A notable innovation appeared in December 2025 when TA584 incorporated personalized physical mail imagery into email lures.

In July 2025, TA584 adopted the ClickFix social engineering technique, representing a significant shift from previous delivery methods.

ClickFix, first observed in 2024, exploits user trust through fake error messages and dialogue boxes that trick victims into copying, pasting, and executing malicious PowerShell commands on their systems.

Current TA584 campaigns employ multi-stage ClickFix implementations. Initial emails contain unique, per-target URLs performing geofencing and IP filtering.

Successfully filtered recipients reach customized landing pages featuring “Slide” CAPTCHA challenges that align with email lure themes.

Upon CAPTCHA resolution, victims encounter ClickFix attack instruction pages guiding them through steps to execute PowerShell commands manually. These commands retrieve remote intermediate PowerShell scripts containing obfuscated code that deploys final malware payloads.

Throughout 2025, TA584 primarily utilized 404 TDS (Traffic Distribution System), a sophisticated filtering platform employed by advanced cybercriminal actors since 2021.

The 404 TDS responds with “404 Not Found” codes while using meta refresh methods to automatically redirect users to payload sites. These links remain time-limited, typically expiring after one day.

Domain rotation occurs frequently, with new domains typically registered and deployed weekly. However, hosting IP addresses remain static for extended periods.

For example, IP address 94[.]159[.]113[.]37 (AS216234) has hosted TA584 infrastructure since April 2025. This operational pattern frequent domain rotation coupled with stable hosting infrastructure complicates attribution while maintaining operational continuity.

TA584 historically concentrated targeting on North American, United Kingdom, and Irish organizations.

July 2025 marked significant geographic expansion when the actor began consistently targeting Germany at substantially higher volumes compared to limited 2023 campaigns.

Throughout summer 2025, TA584 emphasized European targeting before returning focus to North America by fall. Limited Australian targeting has occurred since spring 2025.

Tsundere Bot Malware Analysis

While TA584 previously distributed various payloads including Ursnif (2020-2022), LDR4 (2022-2023), WarmCookie (2024), Xeno RAT (2024), and Cobalt Strike (2024), late November 2025 marked the introduction of Tsundere Bot.

This newly observed malware appeared in multiple December 2025 campaigns and now represents a favored payload alongside XWorm.

Tsundere Bot operates as malware-as-a-service (MaaS) with backdoor and loader capabilities. The malware requires Node.js installation, handled through MSI installers or PowerShell scripts generated from command-and-control (C2) panels identified as “Tsundere Netto” and “Tsundere Reborn.”

According to Kaspersky research, multiple threat actors employ Tsundere Bot, delivered through various vectors including remote monitoring and management (RMM) tools following web injects and fake video game installers.

Tsundere Bot implements several sophisticated operational features:

EtherHiding C2 Resolution: The malware employs EtherHiding techniques, connecting to the Ethereum blockchain via multiple RPC providers to retrieve C2 addresses and configurations through Web3 smart contracts and wallets defined during installation. A consensus mechanism selects the most commonly returned C2 URL from multiple providers, with hardcoded fallback C2 addresses embedded in installer scripts.

WebSocket Communication: C2 communications utilize WebSocket protocols, establishing persistent bidirectional channels for command execution and data exfiltration.

Geographic Evasion: System locale checks cause execution termination if CIS country languages (Russian, Ukrainian, Belarusian, Kazakh) are detected, indicating developer geographic restrictions.

System Profiling: The malware collects comprehensive system information including CPU/GPU specifications, username and hostname, Windows version, and volume serial numbers. This data generates unique victim identifiers transmitted to C2 infrastructure.

Connection Maintenance: Ping/pong heartbeat mechanisms maintain persistent C2 connections, ensuring command delivery reliability.

Arbitrary Code Execution: C2 servers can transmit arbitrary JavaScript code for client-side execution, enabling flexible post-compromise operations.

The Tsundere Bot control panel, which allows public account creation, provides threat actors with comprehensive bot management capabilities.

Features include bot control panels filterable by IP address, country code, username, and hostname; user settings for MaaS license key application; build systems generating MSI or PowerShell installers; autotask management for custom.

Node.js scripts configured to run automatically upon bot connection; bot marketplace functionality for buying and selling compromised systems; and SOCKS5 proxy configuration enabling bots to function as network proxies.

The first TA584 Tsundere Bot campaign occurred November 28, 2025, impersonating the UK Health and Safety Executive. Subsequent December campaigns impersonated document review tools, construction companies, and mobile service providers.

Since mid-2024, TA584 has consistently deployed XWorm remote access trojan configured with the “P0WER” variant, named after the AES encryption key used in this specific version.

XWorm, available for sale on criminal forums since 2022, functions as a remote access trojan with ransomware capabilities, utilized by threat actors across various sophistication levels.

The P0WER configuration represents a complete malware-as-a-service product. Proofpoint has observed this configuration deployed by unrelated threat clusters using identical execution methods, suggesting centralized distribution through underground markets.

Malware execution invokes a method designated BIG.BOOM, performing process hollowing techniques.

The loader starts legitimate, signed Microsoft utility RegSvcs[.]exe in a suspended state, empties its memory space, and replaces content with the XWorm payload.

This fileless detonation method maintains malware entirely in RAM while masking activity under trusted system process identities. Scripts subsequently wipe clipboard contents, removing traces of initial ClickFix commands.

Indicators of compromise

Indicator	Description	First Seen
94[.]159[.]113[.]37	TA584 Host | AS216234 Komskov Vadim Alexandrovich	April 2025
85[.]236[.]25[.]119	Tsundere Bot C2	9 December 2025
80[.]64[.]19[.]148	XWorm C2	10 November 2025
85[.]208[.]84[.]208	XWorm C2	9 September 2025
178[.]16[.]52[.]242	XWorm C2	27 October 2025
94[.]159[.]113[.]64	XWorm C2	28 March 2025
hxxp://94[.]159[.]113[.]37/ssd[.]png	ClickFix Payload URL	September 2025
bbedc389af45853493c95011d9857f47241a36f7f159305b097089866502ac99	SHA256 Remote PowerShell Script Leading to XWorm	December 2025
441c49b6338ba25519fc2cf1f5cb31ba51b0ab919c463671ab5c7f34c5ce2d30	SHA256 XWorm SharpHide Payload	December 2025

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.