Tofsee is a modular Windows botnet with capabilities that include proxying, spam delivery, and cryptocurrency mining. This March 2023 investigation examines the activity observed through its modules and infrastructure.
The published analysis describes spam traffic carried through the proxy module, extracts a miner configuration, and follows activity associated with Masari mining. It also distinguishes a module being delivered from evidence that the module was actually active.
The geographic observations come from Bitsight’s sampled visibility in March 2023. They provide context for the observed botnet activity and should not be interpreted as a complete or current distribution of infected systems.