TsunamiKit

TsunamiKit is a Windows malware family operated by WageMole.

Background

TsunamiKit is a multi-stage malware toolkit developed in Python and .NET.

Its execution chain is made up of several modules, among them TsunamiLoader, TsunamiInjector, TsunamiInstaller, TsunamiPayload, and the central TsunamiClient. The toolkit's name comes from the developer's repeated use of "Tsunami" across components, as seen in strings like "C# Tsunami Dist Version 3.0.0" or "Tsunami Stable\Tsunami Payload".

What the core module does varies by variant. It either steals information by exfiltrating browser data or generates revenue by dropping cryptocurrency miners such as XMRig and NBMiner. It additionally fingerprints the infected host and routes its command-and-control (C&C) traffic through the Tor network.

Although InvisibleFerret delivered it in November 2024, older samples going back to November 2021 indicate TsunamiKit is an existing dark web project that the APT actors repurposed.

Source: Malpedia (Fraunhofer FKIE).