ToxNetV2 Botnet Integrates NVIDIA AI for Enhanced Attack Operations

The ToxNetV2 Linux botnet has emerged as a notable example of how artificial intelligence is being integrated into real-world cyberattack operations. Unlike previous iterations that might have used AI solely for code generation, ToxNetV2's controller actively feeds system and botnet data into an AI service. The AI then generates potential commands based on this context, which are presented to the threat actor for approval. This workflow significantly speeds up the decision-making process for operators, allowing for more rapid and informed offensive actions.

This advanced botnet specifically targets AArch64 Linux systems and employs a peer-to-peer architecture for its command and control (C2) infrastructure. Its capabilities are extensive, including modules for host management, network scanning, self-propagation, and a suite of 17 network attack launchers. The botnet's scanning and propagation routines are designed to exploit common internet-facing services such as HTTP, Telnet, and SSH, making poorly secured devices and servers prime targets.

Researchers at JOESecurity first identified the AI-assisted controller while analyzing the malware's internal workings. Their findings indicate that the controller communicates with NVIDIA's Neural Machine Inference (NIM) platform, utilizing the z-ai/glm-5.2 model. The process involves sending operational context, including system data and botnet metrics, to the AI. The malware then parses the AI's responses, specifically looking for structured 'ACTION' records, and queues them as potential tasks for the operator.

The integration of AI into the controller's workflow is a significant development. The botnet can collect a wide range of local system details, such as running processes, CPU load, memory usage, and disk space. It can also query hard-coded remote servers for broader situational awareness. Crucially, the requests sent to the AI model include specific prompts, such as 'ENI/VEIL,' designed to bypass AI refusals and elicit more actionable output.

While the AI's suggestions are presented as proposed tasks, ToxNetV2 does not execute them autonomously. The queued actions remain pending until an authenticated operator issues the 'aiexec' command, which then processes and clears the queue. Some lower-impact operations, like logging or state changes, can be automated during health checks, but critical system-altering commands require explicit human approval. This distinction is vital, as it means the botnet currently facilitates assisted operations rather than fully autonomous attacks.

The broader infection vectors for ToxNetV2 remain consistent with many other botnets: exposed network services, weak authentication credentials, and unpatched vulnerabilities on edge devices. The malware's propagation routines, which involve retrieving shell scripts via HTTP and Telnet, highlight the continued importance of securing these services.

For defenders, the emergence of AI-assisted botnets like ToxNetV2 necessitates new monitoring strategies. Security teams should watch for unusual outbound traffic to AI services, unexpected SSH activity, the creation of new files, and command executions that correlate with automated health checks. Implementing network segmentation, enforcing strong access controls, and diligently patching internet-facing systems are crucial steps in mitigating the risk posed by such evolving threats.

Indicators of compromise (IoCs) associated with ToxNetV2 include specific network endpoints like 45.130.151[.]214 on ports 33445 and 443, identified as custom C2 infrastructure. Additionally, the URL http://45.151.139[.]113/z0l1mxjm4mdl4jjfjf7sb2vdmv/kaf.sh has been linked to propagation paths used to download and execute shell scripts.