top title background image

ToxNetV2: An AI-Assisted Botnet Controller

Published on: 25.08.2026

 


Introduction


ToxNetV2 is an AArch64 Linux peer-to-peer botnet that integrates an LLM into the operational workflow of its controller. 

As uncovered in the Joe Reverser analysis, the controller collects host and botnet telemetry, sends that context to NVIDIA NIM, parses selected model responses into structured actions, and queues those actions for operator approval. 




The resulting workflow is straightforward: 

telemetry → LLM analysis → structured actions → operator approval → execution 

The system is not fully autonomous or self-modifying. The operator remains the final approval point for its higher-impact AI-generated actions. Once approved, however, those actions can reach local command execution, file writes, remote SSH, persistent state, and a compilation workflow. 

That connection between model output and real operational capabilities is the central finding of the Joe Reverser analysis.


AI Runs on the Controller


The same ToxNetV2 binary can operate either as the controller or as an ordinary bot. 

Joe Reverser’s control-flow analysis shows that when the malware restores its Tox state from c2.data, it enters controller mode and initializes the AI subsystem. Without that state, it operates as a normal bot. 

Only the controller runs the automated AI review loop. 

This creates a clear division of roles: ordinary bots provide scanning, host-control, propagation, and network-attack capabilities, while the controller manages the fleet and hosts the AI-assisted decision layer. 

The AI is therefore not distributed across the botnet. It sits at the point where operational information from the controller and fleet can be turned into decisions.


How the AI Pipeline Works


The controller communicates with NVIDIA NIM using the z-ai/glm-5.2 model. 

The recovered AI paths identified by Joe Reverser support both direct operator interaction with the model and several operational review workflows. 

The latter collect information about the current environment, including botnet counters and host telemetry such as process state, system load, memory usage, and disk usage. Broader reviews can also incorporate information from a hard-coded remote server. 

As shown in the image below, these requests use embedded operational prompts, including ENI/VEIL, an explicit jailbreak intended to suppress refusals and elicit actionable output. 




Responses from the review workflows may contain structured "ACTION:" records, which the malware converts into pending actions. Direct aiprompt responses remain textual and are not passed to this parser.

This creates an operational feedback loop: 

observe current state → request analysis → parse recommendations → queue proposed actions 

The important point is that model output does not remain purely textual. Parts of it can become structured state understood by the malware.


From Recommendations to Operations


The recovered action set ranges from logging and configuration changes to operations with direct system impact. 

According to the Joe Reverser analysis, and as shown in the image below, the controller can translate model-generated recommendations into actions affecting local state, files, shell execution, remote SSH, and compilation. 





Structured "ACTION:" records are not executed immediately. They remain pending until an authenticated operator issues aiexec, which executes and clears the complete queue.

A limited exception exists for some lower-impact logging, memory, and state operations, which can be processed automatically during health analysis. 

This makes the implementation better described as an operator-gated AI operations layer than as a fully autonomous agent. 

The LLM participates in the decision process, while the malware provides the operational primitives and the operator retains control over the final transition to higher-impact execution.


Limits on Autonomy


The recovered implementation does not support claims that ToxNetV2 autonomously rewrites or redeploys itself. 

This is an important distinction in the Joe Reverser findings: some action names imply more capability than the underlying handlers actually provide. A worker-restart action, for example, records a restart request rather than directly restarting a process. 

The compilation path similarly builds fixed local source code and produces an output binary, but no subsequent automated deployment stage was recovered. 

There is therefore no evidence of a complete loop in which the model independently writes new malware code, compiles it, distributes it, and replaces existing bots. 

The stronger and more defensible finding is narrower: 

ToxNetV2 places LLM output between operational telemetry and real controller-side execution mechanisms. 

That alone gives the model a meaningful role in botnet operations.


Why It Matters


ToxNetV2 demonstrates an LLM integration pattern in which the model becomes part of a malware controller’s operational feedback loop. 

The dangerous capabilities already exist in the malware. The AI layer does not create shell execution, SSH access, file writing, or compilation from nothing. 

What it adds is a mechanism for interpreting operational state and proposing how those capabilities should be used. 

That produces a chain of: 

observation → model interpretation → structured proposal → human approval → system change 

The human approval boundary limits autonomy, but it does not isolate the model from operational effects. Once a proposal is approved, the resulting action can reach real execution mechanisms. 

This is what makes the behavior recovered by Joe Reverser particularly interesting: the LLM is not an isolated component, but part of the controller’s operational decision path.


Operational Context


The AI subsystem sits inside a broader Tox-based botnet with encrypted peer-to-peer command and control, host-management capabilities, scanner workers, self-propagation logic, and 17 network-attack launchers. 

The wider architecture mapped in the new Joe Reverser analysis provides the context for the AI subsystem described here. 

The malware embeds 25 Tox bootstrap and relay records. Twenty-three match public Tox infrastructure, while two point to 45.130.151[.]214. 

The same address is also used as the AI subsystem’s hard-coded root SSH target, suggesting that it represents actor-controlled infrastructure. 

HTTP and Telnet propagation paths also attempt to retrieve and execute a shell script from 45.151.139[.]113, although the payload was unavailable during analysis. 

The complete infrastructure classification, command surface, attack map, and propagation CVE mapping are provided separately in the appendices.


AI Command Reference


  • aistatus → Reports AI provider state, counters, intervals, pending actions, and errors.
  • aiprompt <text> → Sends arbitrary operator text to the model and returns the response.
  • aifix <description> → Requests corrective actions and queues recognized results.
  • aistrategy → Requests operational strategy and task-weight recommendations.
  • aitoggle → Enables or disables the AI module.
  • aiconfig <key> <value> → Changes AI configuration, credentials, tokens, or remote SSH settings.
  • aiexec → Executes and clears pending AI actions.
  • aidaily → Runs the comprehensive operational review.
  • aimemory → Returns recent AI memory.
  • aiideas → Requests improvement ideas and queues recognized actions.

Structured AI Actions


  • restart_worker → Records a worker restart request.
  • weight_task → Stores a task-weight setting.
  • set_kv → Updates key-value state when configured.
  • log → Adds an AI operations log entry.
  • alert → Sends an AI-generated operator alert.
  • shell_cmd → Executes a model-supplied local command.
  • write_file → Creates or overwrites a local file.
  • ssh_check → Executes a model-supplied command remotely as root.
  • compile_deploy → Runs a fixed local cross-compilation workflow.
  • kv_memory → Stores an observation in AI memory.


Conclusion


The Joe Reverser analysis shows that ToxNetV2 integrates NVIDIA NIM into the decision workflow of its botnet controller. 

The controller observes its environment, sends operational context to an LLM, converts selected responses into structured actions, and places those actions behind an operator approval boundary. 

This is not a fully autonomous or self-modifying botnet. 

But the AI integration is operationally significant: model-generated decisions can ultimately influence shell execution, files, remote infrastructure, persistent state, and compilation. 

The key finding is therefore not simply that ToxNetV2 uses an LLM. 

It is that the LLM has been inserted into the botnet controller’s feedback loop between observation and action.


Indicators of Compromise (IOCs)

  • 45.130.151.214:33445
  • 45.130.151.214:443
  • http://45.151.139[.]113/z0l1mxjm4mdl4jjfjf7sb2vdmv/kaf.sh


Appendix A.  Embedded Tox Bootstrap and Relay Nodes

The following classification is based on exact DHT public-key matching against https://nodes.tox.chat/.

Custom infrastructure / high-confidence IOC:

The following records have no matching DHT public key in the official node list. Their classification is reinforced by the use of the same IP as the AI module's hard-coded root SSH target.

  • 45.130.151[.]214:33445
  • 45.130.151[.]214:443

Public nodes:

  • 205.185.115.131:53
  • 49.12.229.145:33445 → same DHT key listed as tox1.mf-net.eu
  • 3.0.24.15:33445
  • 139.162.110.188:33445
  • 49.13.50.193:33445 → same DHT key listed as tox2.mf-net.eu
  • 144.172.88.203:33445
  • 172.104.215.182:33445
  • 114.35.245.150:33445 → same DHT key listed as tox.initramfs.io
  • 51.79.254.78:33445 → same DHT key listed as tox3.mf-net.eu
  • 188.214.122.30:33445
  • 43.198.227.166:33445
  • 95.181.230.108:33445
  • 165.227.194.41:443 → same DHT key listed as tox.hidemybits.com
  • 141.95.53.16:33445 → same DHT key listed as tox4.mf-net.eu
  • 188.245.84.166:33445
  • 86.107.187.54:33445
  • 119.59.101.63:33445
  • 167.17.40.142:33445
  • 172.86.77.39:33445

These hostname mappings indicate that the same DHT identity is currently published under that hostname. They do not establish that the hostname still resolves to the IP embedded in the sample.

Public nodes with special availability status:

  • 24.87.200.32:33445 → same DHT key listed as tox.abilinski.com. UDP available; TCP relay unavailable.
  • 91.146.66.26:33445 → UDP available; TCP relay unavailable.
  • 145.239.1.105:33445 → UDP and TCP unavailable. The node was listed as offline at the time of classification.
  • 5.19.249.240:38296 → UDP unavailable; TCP relay available on ports 38296 and 3389.

Appendix B. Available Commands and Attack Launcher Map

Controller-Side Commands:

  • help → Returns the controller help message.
  • help atk → Returns the attack-command help section.
  • ping → Recognized as a liveness check.
  • list → Lists online bot friends.
  • names → Enumerates bot names and status information.
  • stats → Reports the total number of online, Linux, and Windows bots.
  • exec <bot> <command> → Forwards a command to a specific bot using its friend number.
  • mass <command> → Sends a command to every online bot, excluding the controller.
  • masslinux <command> → Sends a command only to online bots classified as Linux.

Bot-Side Host and Scanner Command:

  • startscan → Starts the HTTP, Telnet, and SSH scanners together with the process killer, provided that no analysis process was detected.
  • stopscan → Stops the three scanner families but does not stop the process killer.
  • starttelnet / stoptelnet → Starts or stops the Telnet scanner workers.
  • startssh / stopssh → Starts or stops the SSH banner scanner.
  • startkiller / stopkiller → Starts or stops the process killer independently of the scanner group.
  • startlocker → Starts a child process that kills newly created wget, curl, tftp, and reboot processes.
  • brick → Executes the destructive wiper implemented.

Bot-Side Network-Attack Commands:

  • vse → Starts Valve Source Engine query traffic. Stop command: stopvse.
  • wra → Starts the WRA module. Stop command: stopwra.
  • udpts → Starts TeamSpeak 3-oriented UDP traffic. Stop command: stopudpts.
  • tcp_socket → Starts a TCP socket flood. Stop command: stop_tcp_socket.
  • tcp_bypass → Starts the TCP bypass variant. Stop command: stop_tcp_bypass.
  • tcp_syndata → Sends TCP SYN packets carrying data. Stop command: stop_tcp_syndata.
  • tcp_stomp → Starts the TCP stomp module. Stop command: stop_tcp_stomp.
  • tcp_syn → Starts a TCP SYN flood. Stop command: stop_tcp_syn.
  • tcp_socket_hold → Opens and holds TCP connections. Stop command: stop_tcp_socket_hold.
  • tcp_ack → Starts a TCP ACK flood. Stop command: stop_tcp_ack.
  • brazilian → Starts the Brazilian Handshake module. Stop command: stop_brazilian.
  • raknet → Starts RakNet-oriented traffic. Stop command: stop_raknet.
  • udp_hex → Sends hexadecimal UDP payloads. Stop command: stop_udp_hex.
  • udp_raw → Starts raw UDP traffic. Stop command: stop_udp_raw.
  • udp_plain → Starts a plain UDP payload flood. Stop command: stop_udp_plain.
  • udp_bypass → Starts the UDP bypass variant. Stop command: stop_udp_bypass.
  • openvpn → Starts OpenVPN-oriented traffic. Stop command: stop_openvpn.
  • stop → Generic network-attack stop command recognized by the dispatcher.

AI Commands Available to Authenticated Operators:

  • aistatus → Reports the provider state, request counters, configured intervals, pending actions, and the most recent error.
  • aiprompt <text> → Sends arbitrary text to NVIDIA and returns the response without parsing ACTION: lines.
  • aifix <description> → Requests three corrective actions and queues the parsed results.
  • aistrategy → Requests operational strategy and task-weight changes, then queues the parsed actions.
  • aitoggle → Enables or disables the AI module.
  • aiconfig <key> <value> → Changes AI intervals, the NVIDIA key, the Puter token, or the remote SSH password.
  • aiexec → Executes and clears all pending AI actions.
  • aidaily → Runs the comprehensive local and remote operational review and queues the resulting actions.
  • aimemory → Returns recent AI memory.
  • aiideas → Requests self-improvement ideas and queues the parsed actions.

Appendix C. Self-Propagation CVE Mapping

Exploits with a reliable CVE attribution:

  • Dasan GPON routers diagnostic injection (TCP/8080) → /GponForm/diag_Form, dest_host parameter; CVE-2018-10561 and CVE-2018-10562
  • Dasan GPON routers diagnostic injection (TCP/80) → /GponForm/diag_Form, dest_host parameter; CVE-2018-10561 and CVE-2018-10562
  • Realtek SDK miniigd/UPnP injection (TCP/52869) → /picsdesc.xml, NewInternalClient element; CVE-2014-8361
  • Huawei HG532 DeviceUpgrade injection (TCP/37215) → /ctrlt/DeviceUpgrade_1, NewStatusURL element; CVE-2017-17215
  • TR-064 modem NTP-server injection (TCP/7574 and TCP/5555) → /UD/act?1, NewNTPServer1 element; CVE-2016-10372
  • D-Link router HNAP interface injection (TCP/80) → /HNAP1/, SOAPAction header; CVE-2015-2051
  • MVPower/JAWS DVR web shell (TCP/80) → Unauthenticated /shell endpoint; CVE-2016-20016
  • D-Link WANIPConn1 SOAP injection (TCP/49152) → /soap.cgi?service=WANIPConn1, NewInternalClient element; CVE-2013-7471
  • Drupalgeddon 2 (TCP/80) → Drupal AJAX registration request, mail_a field; CVE-2018-7600
  • Zyxel ZTP command injection (TCP/443) → /ztp/cgi-bin/handler; CVE-2022-30525
  • Hikvision web-server injection (TCP/80) → /SDK/webLanguage, language element; CVE-2021-36260
  • GoAhead CGI LD_PRELOAD injection (TCP/80) → /cgi-bin/index, LD_PRELOAD=/proc/self/fd/7; CVE-2017-17562
  • Tenda AC15 router USB-unload command injection (TCP/80) → /goform/setUsbUnload, deviceName parameter; CVE-2020-10987
  • D-Link NAS authentication bypass and command injection (TCP/80) → /cgi-bin/nas_sharing.cgi, user=messagebus with empty password and system parameter; CVE-2024-3272 and CVE-2024-3273)
Exploits without a reliable CVE attribution:
  • Netgear-style setup.cgi injection (TCP/80) → /setup.cgi, todo=syscmd, cmd parameter
  • D-Link-style language injection (TCP/81) → /language/Swedish&&
  • Generic CGI semicolon injection (TCP/8443) → /cgi-bin/;
  • board.cgi command injection (TCP/8080) → /board.cgi, cmd parameter
  • Raw shell-command carrier (TCP/5555) → sh -c command followed by the 0009host:: marker
  • Login newline injection (TCP/2031) → /login/index.php, username=root%0A
  • AJAX command execution (TCP/80) → /ajax.asp, action=execute, command parameter
  • RPC2 session injection (TCP/80) → /RPC2, session value
  • Login password injection (TCP/80) → /login/validate, password field
  • Firmware-upgrade CGI injection (TCP/80) → /cgi-bin/admin/upgrade.cgi, system field
  • stok command injection (TCP/80) → /stok=0/ds, system.do_command.command field