MALWARE FAMILY

Tofsee

Internal ID: win.tofsee

aliases

Last seen:Mar 17, 2026

Intelligence Profile

According to PCrisk, Tofsee (also known as Gheg) is a malicious Trojan-type program that is capable of performing DDoS attacks, mining cryptocurrency, sending emails, stealing various account credentials, updating itself, and more.

Cyber criminals mainly use this program as an email-oriented tool (they target users' email accounts), however, having Tofsee installed can also lead to many other problems.

Threat Analysis

Tofsee is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→https://blog.checkpoint.com/security/march-2023s-most-wanted-malware-new-emotet-campaign-bypasses-microsoft-blocks-to-distribute-malicious-onenote-files/

→https://blog.talosintelligence.com/2022/02/threat-roundup-0204-0211.html

→https://blog.talosintelligence.com/tofsee-spam/

→https://gist.github.com/larsborn/0ec24d7b294248c51de0c3335802cbd4

→https://info.spamhaus.com/hubfs/Botnet%20Reports/2022%20Q3%20Botnet%20Threat%20Update.pdf

→https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf

→https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q2%20Botnet%20Threat%20Update.pdf

→https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q3%20Botnet%20Threat%20Update.pdf

→https://intel471.com/blog/privateloader-malware

→https://lokalhost.pl/txt/peering.into.spam.botnets.VirusBulletin2017.pdf

Quick Facts

TypeMalware Family

Aliases1

Also Known As

win.tofsee

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Tofsee