Loading threat actor…
WraithTools is the seller name associated with marketing x47.c, a Windows botnet and remotely operated attack toolkit. The offering is sold in tiered packages and is marketed with a command-and-control panel, fast-flux configuration, information-stealer logging, proxy management, host software-management functions, concealment features, and distributed-denial-of-service operations. x47.c is advertised as supporting browser-password, cookie, Discord-token, cryptocurrency-wallet-data, and AI-service-token theft; SOCKS5 relaying through compromised hosts; and DDoS methods including HTTP, slow-connection, TCP, UDP, TLS-stress, reflection, and amplification attacks. WraithTools also promotes an AI API credit-draining function that sends billable requests directly to AI providers using an operator-supplied valid API key, potentially exhausting prepaid credits or generating charges. Advertised host-maintenance and concealment features include startup-entry and scheduled-task persistence, local fallback actions, Windows Defender exclusions, optional process hollowing and privilege escalation, and a rootkit module intended to remove artifacts from other malware. The advertised AI-assisted persistence module uses xAI Grok to select from predefined maintenance actions. Available evidence establishes the marketing and claimed functionality of x47.c, but does not establish its initial-access mechanism, scale of infections, verified victims, measured attack capacity, or confirmed losses.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
18 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
1 malware family Mallory has associated with this actor across public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.