“PseudoManuscrypt”, a new botnet, has been identified infecting approximately 35,000 Windows computers throughout 2021. Kaspersky researchers found PseudoManuscrypt malware to distribute itself in two (2) ways. The first and most common is through a Malware as a Service (MaaS) platform that is hidden in pirated software installers. The pirated software is often hosted on malicious websites that are found through search engines. In at least one (1) case, PseudoManuscrypt was deployed using the “Glupteba” botnet. The Glupteba botnet has made the news recently as Google has attempted to disrupt their infrastructure, which we reported about in the December 10th FLASH update. The PseudoManuscrypt malware hosts an assortment of malicious capabilities such as stealing VPN data, keystroke logging, recording audio and the computer screen, as well as stealing clipboard information. The PseudoManuscrypt has been in active development since March 2021. The analysts found connections to the “Fabookie” malware, China-based APT41, and identified comments written in Chinese, though these connections are not strong enough to make a judgement of the origin of the malware. CTIX analysts are monitoring this botnet and will update with any future developments.