ToxNetV2, an AArch64 Linux peer-to-peer botnet, integrates a large language model into its controller workflow to turn botnet and host telemetry into proposed operational actions.
The implementation connects NVIDIA NIM-hosted z-ai/glm-5.2 model output to controller-side functions including local shell execution, file writes, remote SSH commands, persistent state changes, and cross-compilation.
Analysis published by Joe Reverser shows the malware is not a fully autonomous, self-modifying botnet.
Instead, it uses an operator-gated model: telemetry is collected, sent for LLM analysis, converted into structured ACTION: records, queued as pending tasks, and executed only after an authenticated operator issues the aiexec command.
That workflow places human approval between AI-generated recommendations and higher-impact operations. However, model output can still ultimately reach real execution mechanisms.
The same ToxNetV2 binary can reportedly function either as an ordinary bot or as the botnet controller.
When the malware restores Tox state from a file named c2.data, it enters controller mode and initializes its AI subsystem. Without that state, it operates as a standard bot.
This separates the botnet’s operational roles. Ordinary nodes retain capabilities for scanning, propagation, host management, and network attacks, while the controller coordinates the fleet and handles AI-assisted decision-making.
The LLM is therefore not embedded across every compromised host; it sits centrally where controller and bot telemetry can be analyzed together.
The controller’s AI review paths collect system and botnet information, such as process state, load average, memory consumption, disk usage, and botnet counters.
Broader reviews can additionally incorporate information retrieved from a hard-coded remote server.
ToxNetV2 Linux Botnet
Joe security Researchers said that, the malware then sends that context to NVIDIA NIM using embedded prompts, including an ENI/VEIL jailbreak prompt designed to reduce model refusals and return actionable responses.
Not all model responses become executable actions. The aiprompt command, for example, accepts arbitrary operator text and returns an ordinary textual response.
However, automated workflows including aifix, aistrategy, aidaily, and aiideas can parse responses containing ACTION: entries and transform recognized records into pending controller actions.
Those actions include shell_cmd, which runs a model-supplied local shell command; write_file, which creates or overwrites local files; and ssh_check, which executes a model-supplied command remotely as root.
Other supported actions can store state, add log entries, issue operator alerts, save AI memory, alter task weights, and run a fixed compilation workflow.
Crucially, structured actions remain in a queue until an operator approves them through aiexec, which processes and clears the complete pending-action list.
Some lower-impact operations, including logging, memory, and state handling, may be processed automatically during health analysis.
This makes ToxNetV2 better characterized as an AI-assisted operations layer than a hands-off autonomous agent.
The recovered code does not establish a complete autonomous cycle in which the model writes malware, compiles it, deploys it, and replaces existing bot instances.
Certain action names also overstate what their handlers do. A restart_worker action records a restart request rather than directly restarting a process.
Similarly, the compile_deploy path compiles fixed local source code into an output binary, but researchers did not recover an automated distribution or redeployment stage.
The significant finding is narrower: ToxNetV2 inserts LLM interpretation into the path between operational telemetry and privileged controller functions.
The AI component operates within a broader Tox-based architecture featuring encrypted peer-to-peer command-and-control, propagation logic, scanning workers, host-control features, and 17 network-attack launchers.
The malware includes 25 Tox bootstrap and relay records; 23 correspond to public Tox infrastructure, while two reference 45.130.151[.]214, which is also configured as the AI module’s root SSH target access.
HTTP and Telnet propagation routines attempt to retrieve and execute a shell script from 45.151.139[.]113, although the payload was unavailable during analysis.
The overlap between the SSH endpoint and botnet infrastructure suggests the address is actor-controlled.
ToxNetV2 illustrates a consequential malware design pattern: the LLM does not supply capabilities the botnet lacks, but it helps interpret conditions and recommend how existing shell, SSH, file, and infrastructure-control functions should be used.
IOCs
| Type | Indicator |
|---|---|
| IP address and port | 45.130.151.214:33445 |
| IP address and port | 45.130.151.214:443 |
| URL | http://45.151.139[.]113/z0l1mxjm4mdl4jjfjf7sb2vdmv/kaf.sh |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide
