Language models gradually get to the tools, where the work of the malware directly depends on the response of the AI. The specialists of Joe Security discovered the ToxNetV2 botnet, the controller of which transmits data on infected devices of the model GLM-5.2 through the platform NVIDIA NIM, receives recommendations and turns part of the answers into real commands.
ToxNetV2 is a peer-to-peer botnet for Linux systems on the AArch64 architecture. The same malicious file can work like a regular bot or as a central controller. The role depends on the state of the Tox network. It is on the controller that the AI module is launched, while the other nodes scan the devices, distribute malware and execute commands.
The controller collects information about the botnet and the infected system, including running processes, CPU booting, memory usage, and disk. ToxNetV2 then sends the collected context of the GLM-5.2 model. The queries have special ENI/VEIL instructions built in, which try to make the language model ignore the restrictions and issue recommendations suitable for implementation.
The peculiarity of ToxNetV2 is how the malware processes the model responses. It searches for ACTION format entries, disassembles the instructions contained therein, and places the appropriate actions in the queue. Therefore, the AI response does not remain the usual text advice, but becomes part of the internal state of the controller.
The model may propose to change settings, save data in memory, write or overwrite a file, execute a local shell command, connect to a remote server with root rights, or run a pre-prepared compilation process. Some secure operations the controller is able to perform automatically, but commands with serious consequences are waiting for the authenticated operator to confirm them.
Therefore, it is not yet possible to call ToxNetV2 a completely autonomous AI-botnet. The specialists did not find a mechanism that would allow the model to rewrite malicious code, to compile the new version, to distribute it and to replace the working copies. Even when it comes to restarting the workflow, the program only saves the corresponding request, and does not execute it on its own.
At the same time, the AI is already built directly into the circuit where decisions are made. The scheme looks like this: the controller monitors the state of the network, the model analyzes the data and offers actions, the operator confirms the queue, after which the malware executes the commands. Thus, the language model can affect the work of infected systems, although the final control remains with the person.
Outside the AI module, ToxNetV2 has a full set of botnet features. The specialists found mechanisms that allow it to spread independently, HTTP, Telnet and SSH scanners, means for managing infected nodes and 17 modules for network attacks. Built-in mechanisms also attempt to exploit a number of long-known vulnerabilities in routers, video recorders, web applications, and other network hardware.
ToxNetV2 is a peer-to-peer botnet for Linux systems on the AArch64 architecture. The same malicious file can work like a regular bot or as a central controller. The role depends on the state of the Tox network. It is on the controller that the AI module is launched, while the other nodes scan the devices, distribute malware and execute commands.
The controller collects information about the botnet and the infected system, including running processes, CPU booting, memory usage, and disk. ToxNetV2 then sends the collected context of the GLM-5.2 model. The queries have special ENI/VEIL instructions built in, which try to make the language model ignore the restrictions and issue recommendations suitable for implementation.
The peculiarity of ToxNetV2 is how the malware processes the model responses. It searches for ACTION format entries, disassembles the instructions contained therein, and places the appropriate actions in the queue. Therefore, the AI response does not remain the usual text advice, but becomes part of the internal state of the controller.
The model may propose to change settings, save data in memory, write or overwrite a file, execute a local shell command, connect to a remote server with root rights, or run a pre-prepared compilation process. Some secure operations the controller is able to perform automatically, but commands with serious consequences are waiting for the authenticated operator to confirm them.
Therefore, it is not yet possible to call ToxNetV2 a completely autonomous AI-botnet. The specialists did not find a mechanism that would allow the model to rewrite malicious code, to compile the new version, to distribute it and to replace the working copies. Even when it comes to restarting the workflow, the program only saves the corresponding request, and does not execute it on its own.
At the same time, the AI is already built directly into the circuit where decisions are made. The scheme looks like this: the controller monitors the state of the network, the model analyzes the data and offers actions, the operator confirms the queue, after which the malware executes the commands. Thus, the language model can affect the work of infected systems, although the final control remains with the person.
Outside the AI module, ToxNetV2 has a full set of botnet features. The specialists found mechanisms that allow it to spread independently, HTTP, Telnet and SSH scanners, means for managing infected nodes and 17 modules for network attacks. Built-in mechanisms also attempt to exploit a number of long-known vulnerabilities in routers, video recorders, web applications, and other network hardware.
