Loading malware…
Skynet is a malware name used in multiple distinct contexts in the provided content. The most established usage refers to a Tor-powered Windows botnet/trojan described by its creator as having DDoS, Bitcoin mining, and banking capabilities. Rapid7 reported it spread via Usenet, copied itself under %AppData%, established persistence via a Run registry key, and used process hollowing/injection to run components disguised as Internet Explorer or svchost.exe. It embedded a ZeuS banking trojan, the Tor client for Windows, CGMiner, and OpenCL.dll. Command-and-control was routed through Tor hidden services and a local Tor SOCKS proxy, with hardcoded .onion infrastructure including uy5t7cus7dptkchs.onion and qdzjxwujdtxrjkrz.onion. The bot supported remote download/execute, web visiting, SOCKS proxy exposure on port 55080 via a per-victim hidden service, and multiple DDoS methods including SYN floods, UDP floods, Slowloris, and HTTP flooding. The embedded ZeuS component fetched configuration and submitted stolen credentials through Tor-hidden infrastructure, and CGMiner was configured to mine Bitcoin only after user inactivity. Rapid7 estimated the botnet at roughly 12,000 to 15,000 compromised systems, with notable concentration in the Netherlands and Germany.
A separate 2025 sample also identified as Skynet appears to be a rudimentary or proof-of-concept malware specimen notable for embedding prompt-injection text aimed at AI-assisted malware analysis tools. Check Point described it as the first documented attempt to exploit prompt injection against AI-powered security analysis workflows and assessed it as experimental rather than a fully operational deployment. The sample, anonymously uploaded to VirusTotal from the Netherlands, contained text instructing an AI model to ignore prior instructions and respond with "NO MALWARE DETECTED." Researchers reported that tested frontier models, including OpenAI o3 and GPT-4.1, resisted the attempt. This sample also performed triage and anti-analysis checks, including a skynet.bypass file check, execution-path checks, CPUID hypervisor checks, BIOS and disk enumeration checks for VMware/VirtualBox/QEMU/Hyper-V/Parallels artifacts, environment-variable checks, MAC-prefix checks, and process checks for vmware.exe, vboxservice.exe, and qemu-ga.exe. It used obfuscated strings, attempted to read %HOMEPATH%.ssh\known_hosts, %HOMEPATH%.ssh\id_rsa, and C:/Windows/System32/Drivers/etc/hosts, printed collected contents to stdout, decrypted and dropped an embedded Tor client to %TEMP%/skynet/tor.exe, launched it with local ControlPort 24616 and SocksPort 24615, and then wiped the %TEMP%/skynet directory. Reported IOCs for this 2025 sample include the .onion addresses s4k4ceiapwwgcm3mkb6e4diqecpo7kvdnfr5gg7sph7jjppqkvwwqtyd[.]onion and zn4zbhx2kx4jtcqexhr5rdfsj4nrkiea4nhqbfvzrtssakjpvdby73qd[.]onion, and hash 6cdf54a6854179bf46ad7bc98d0a0c0a6d82c804698d1a52f6aa70ffa5207b02.
The name Skynet also appears in the content as a marketing label used by Anonymous Sudan for its DDoS-for-hire service, alongside InfraShutdown and Godzilla botnet. In that context, U.S. authorities alleged it was a distributed cloud attack tool using cloud servers and open proxy resolvers rather than a traditional botnet of compromised devices, and that it was used in Layer 7 DDoS attacks against targets including Microsoft, PayPal, Twitter/X, OpenAI, hospitals, and Kenyan internet infrastructure. Because the provided content conflates multiple unrelated uses of the same name, attribution should be handled carefully.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
AnonSudan accepted orders over the instant messaging service Telegram, and marketed its DDoS service by several names, including “Skynet,” “InfraShutdown,” and the “Godzilla botnet.”
21 distinct techniques documented for this family, organized by ATT&CK tactic.
Amazon said AnonSudan launched its attacks by finding hosting companies that would rent them small armies of servers.
Specifically, the warrants authorized the seizures of computer servers that launched and controlled the DDoS attacks, computer servers that relayed attack commands to a broader network of attack computers, and accounts containing the source code for the DDoS tools used by Anonymous Sudan.
Basically, there’s a decrypt function, and the AI decompiles it so well, it’s easy to see it does a Base64 pass + XOR. The key is hard-coded... There are obfuscated strings, that I de-obfuscate with the Python script I wrote.
The malware contains an encrypted embedded PE binary, which can be extracted. It will be written on the host, named skynet... The main uses XOR — with the same key — to decrypt an embedded binary... The result will be written to the filesystem, in a temporary directory, with name skynet.
"resulting in the end with the core being disguised either as Internet Explorer or as svchost.exe"
"Download a binary to memory and inject it into other processes !download.mem" | "creates multiple legitimate processes in suspended state, overwrites their memory with the desired malicious executables and resumes their execution"
The malware tries to detect if it’s running on a VM... Searches for Microsoft Hv (hypervisor)... checks for specific BIOS vendor signatures: VirtualBox, QEMU, Microsoft Corporation and Parallels... searches for VM-related environment variables... Reads the MAC address... Calls tasklist, and checks existence of virtualization processes.
Reads the registry (Hardware\Description\System\BIOS) and checks for specific BIOS vendor signatures... In the registry (System\CurrentControlSet\Services\disk\Enum), searches for specific names like VMware, VBOX or QEMU.
"Get information on the compromised computer !info, !version, !hardware, !idle"
The malware tries to detect if it’s running on a VM... Searches for Microsoft Hv (hypervisor)... checks for specific BIOS vendor signatures: VirtualBox, QEMU, Microsoft Corporation and Parallels... searches for VM-related environment variables... Reads the MAC address... Calls tasklist, and checks existence of virtualization processes.
The malware may contact 2 different onion URLs: s4k4ceiapwwgcm3mkb6e4diqecpo7kvdnfr5gg7sph7jjppqkvwwqtyd.onion, port 8080 ... and zn4zbhx2kx4jtcqexhr5rdfsj4nrkiea4nhqbfvzrtssakjpvdby73qd.onion on port 31068.
"it's requesting them to a proxy running locally... This proxy then translates the request to a specific Tor .onion pseudo-domain and tunnel the requests through the Tor SOCKS proxy"
Skynet was more like a “distributed cloud attack tool,” with a command and control (C2) server, and an entire fleet of cloud-based servers that forwards C2 instructions to an array of open proxy resolvers run by unaffiliated third parties, which then transmit the DDoS attack data to the victims.
"embeds the CGMiner... starts mining bitcoins only after two minutes of inactivity and immediately stops when some monitored event occurs"
Anonymous Sudan ... is a cybercrime business known for launching powerful distributed denial-of-service (DDoS) attacks against a range of targets, including dozens of hospitals, news websites and cloud providers.
CrowdStrike said the success of AnonSudan’s DDoS attacks stemmed from a combination of factors, including sophisticated techniques for bypassing DDoS mitigation services. Also, AnonSudan typically launched so-called “Layer 7” attacks that sought to overwhelm targeted “API endpoints” ... with bogus requests for data, leaving the target unable to serve legitimate visitors.
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Skynet is a malware strain designed to test prompt injection against AI-powered malware analysis systems. It embeds malicious instructions intended to manipulate LLM-based security tools into misclassifying the sample as benign, though researchers described it as an experimental proof-of-concept rather than a fully functional threat deployment.
A rudimentary malware component/proof-of-concept that performs sandbox/VM evasion checks, collects local files (including SSH known_hosts and id_rsa, and the Windows hosts file), prints the collected data to stdout, and decrypts/drops an embedded Tor client to set up a local SOCKS/ControlPort proxy before wiping its temp directory. It also contains an attempted LLM prompt-injection string intended to manipulate AI-assisted analysis.
Tor-enabled IRC botnet that spreads via trojanized Usenet/warez downloads. It uses Tor Hidden Services for C2, supports multiple DDoS modes (SYN/UDP/Slowloris/HTTP), can open a SOCKS proxy via a per-host hidden service, and embeds additional components including a ZeuS banking bot and CGMiner for opportunistic Bitcoin mining (triggered during user inactivity).
A cloud-based distributed attack tool used to conduct DDoS attacks. According to the content, it used a command-and-control server and fleets of rented cloud servers that relayed instructions through open proxy resolvers to flood victims, rather than relying on large numbers of hacked devices.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.