Tofsee: The Modular Spam Botnet That Mines, DDoSes, and Spreads

Tofsee (also known as Gheg) is a modular spam botnet that has been active since May 2013. What sets Tofsee apart from other botnets is its remarkable versatility — combining spam distribution, cryptocurrency mining, DDoS attacks, social media worm propagation, and proxy services in a single modular framework that has survived over a decade of takedown attempts.

Overview & History

Tofsee first appeared in 2013 as a spam-focused botnet, but has continuously evolved by adding pluggable modules that extend its capabilities far beyond email spam. The malware is written in C/C++ and employs process hollowing of svchost.exe as its primary execution technique.

• Primary function: High-volume spam distribution (pharmaceutical, dating, malware delivery)
• Secondary functions: Cryptocurrency mining (Monero), DDoS attacks, social media spreading, traffic proxying
• Architecture: Plugin-based modular system with dynamically loaded functionality
• Resilience: Domain Generation Algorithm (DGA) with .ch and .biz TLDs for C2 failover
• Scale: India accounts for approximately 33% of all infections globally

Modular Architecture

Tofsee's power lies in its plugin system. The C2 server delivers modules to bots based on operational needs:

Technical Analysis

Execution Chain

• Initial execution: Dropper copies itself to %APPDATA% with a randomized filename
• Process hollowing: Creates suspended svchost.exe process, unmaps its memory, and injects Tofsee code T1055.012
• Persistence: Creates a Windows service pointing to the hollowed svchost.exe process T1543.003
• Module loading: Contacts C2 and downloads plugin modules based on bot configuration
• Self-defense: Modifies Windows Firewall rules and blocks access to security vendor update servers T1562.004

Anti-Analysis Techniques

• VM detection: Checks for VMware, VirtualBox, and QEMU artifacts T1497.001
• Debugger detection: Uses IsDebuggerPresent, timing checks, and hardware breakpoint detection T1622
• String encryption: Custom XOR-based string obfuscation for API calls and C2 addresses T1027
• Competing malware removal: Actively scans for and removes other botnet infections to monopolize the host

Domain Generation Algorithm

• Generation rate: 20 domains per week (10 .ch + 10 .biz)
• Seed: Based on current date, providing predictable future domains
• Fallback mechanism: If hardcoded C2 addresses fail, bot falls back to DGA-generated domains
• Registration pattern: Operators pre-register domains days before activation

Distribution Methods

• PrivateLoader PPI: Since 2023, primarily distributed via the PrivateLoader pay-per-install service T1189
• Exploit kits: Historical distribution through RIG and Magnitude exploit kits
• Social media worm: plg_spread module sends malicious links via compromised Facebook/Skype accounts T1204.001
• USB propagation: Copies to removable drives with autorun functionality T1091
• Bundled software: Embedded in cracked software and freeware bundles

MITRE ATT&CK Mapping

Global Scale & Impact

• Geographic distribution: India (33%), Indonesia, Brazil, Pakistan, and Vietnam are the most affected countries
• Mining revenue: Estimated ~200,000 concurrent mining bots generating significant Monero revenue
• Spam volume: Capable of sending millions of emails per day across the botnet
• Infrastructure: Multiple C2 tiers with DGA fallback ensure operational continuity

Detection & Defense

• Process hollowing detection: Monitor for svchost.exe instances with unexpected parent processes or memory regions
• DGA domain blocking: Use GovCERT.ch's published DGA algorithm to predictively block future C2 domains
• Mining detection: Monitor for XMRig-related CPU usage spikes and Stratum mining protocol connections
• SMTP anomalies: Detect high-volume outbound SMTP from non-mail-server endpoints
• Firewall rule monitoring: Alert on unauthorized Windows Firewall modifications
• Service creation monitoring: Log and alert on new service installations, especially those pointing to svchost.exe