Tsundere Botnet MSI Installer To Nodejs Execution

Tim Peck@timpeck

•updated Nov 20, 2025•4•2•108

Detects the Tsundere botnet infection chain where msiexec.exe launches a hidden, encoded PowerShell process, which in turn executes a Node.js spawner script.