Loading story…
Researchers analyzing the AArch64 Linux botnet ToxNetV2 found that its controller submits host and botnet telemetry to NVIDIA NIM's z-ai/glm-5.2 model, parses structured ACTION responses, and places proposed actions into a queue. The same malware binary can operate as either a peer-to-peer controller or an ordinary bot depending on the presence of the c2.data state file; AI-assisted decision processing occurs only on the controller.
ToxNetV2 supports shell execution, file writing, root SSH activity, scanning, propagation through HTTP, Telnet, and SSH, cross-compilation and deployment, network-flooding launchers, CVE-focused exploitation, and destructive wiping. High-impact AI-suggested actions require an authenticated operator to invoke aiexec, indicating assisted rather than autonomous operations, despite an embedded jailbreak prompt. Organizations should prioritize patching internet-facing Linux and IoT systems, removing weak credentials, restricting exposed remote-management services, and validating reported infrastructure including 45.130.151[.]214 and 45.151.139[.]113 before blocking or hunting.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
Joe Security published a technical analysis of ToxNetV2, identifying a Linux AArch64 peer-to-peer botnet whose controller sends host and botnet telemetry to NVIDIA NIM's z-ai/glm-5.2 model. The analysis found that ACTION-formatted model responses are queued and require an authenticated operator to invoke aiexec for high-impact execution, rather than enabling fully autonomous malware operations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cyberveille.ch
Open sourcecybersecuritynews.com
Open sourcejoesecurity.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Palo Alto Networks Unit 42 reported on **TuxBot v3 Evolution**, a previously undocumented modular IoT botnet framework that can infect devices, maintain persistence, communicate over encrypted command-and-control channels, and launch distributed denial-of-service attacks across **17 CPU architectures**. Researchers recovered the botnet’s source code, compiled binaries, Docker-based test infrastructure, and **254 DDoS benchmark reports**, showing active development and testing into early 2026. The malware’s working capabilities include Telnet brute-forcing with **1,496 credentials**, SSH, HTTP, and ADB scanning, plus fallback mechanisms such as a domain generation algorithm and peer-to-peer gossiping. The report said the framework appears to have been developed with heavy **LLM assistance**, which introduced several implementation flaws, including a broken XOR string table, a nonfunctional exploit virtual machine, and a fake `Argon2id` routine that actually behaves like repeated SHA-256 hashing similar to PBKDF2. Despite those defects, Unit 42 assessed the botnet as operationally dangerous because its core infection and DDoS functions work, and the bugs are relatively easy to correct. Telemetry linked the malware to active infrastructure including a command-and-control server at `209.182.237[.]133` and a dropper at `185.10.68[.]127`, with reported ties to the **Keksec/Kaitori** and **AISURU** ecosystems.
Jul 21, 2026
Security researchers reported that **EnemyBot**, a Linux-based botnet linked to the **Keksec** threat actor, expanded from targeting IoT devices into a broader malware platform aimed at exposed Linux servers, web servers, CMS platforms, and even Android devices. The malware is largely derived from **Mirai** and **Qbot**, with public source code and added modules for obfuscation, propagation, command-and-control, reverse shells, packet sniffing, shell command execution, and distributed denial-of-service attacks. Researchers said the botnet aggressively incorporated recently disclosed one-day vulnerabilities, including flaws affecting **Log4j**, **VMware Workspace ONE**, **Spring Cloud Gateway**, **F5 BIG-IP**, **Adobe ColdFusion**, WordPress plugins, and multiple routers and IoT products. Analysis of observed infections showed EnemyBot using remote code execution and shell-based download chains to fetch an `update.sh` script, which then retrieved **13 architecture-specific ELF payloads** for different Linux environments. The malware attempted access to web server `/shell` endpoints and used common utilities such as `wget`, `busybox`, `curl`, and `ftpget` to stage payloads, while its x86 variant performed port scanning, TCP/UDP flooding, host enumeration, duplicate-instance checks, and HTTP POST-based data theft. Researchers also noted encrypted code, anti-analysis checks that terminated execution in sandbox-like environments, and similarities to the short-lived **LolFMe** botnet, underscoring the risk to internet-facing Linux and IoT systems that remain unpatched or allow execution from temporary directories.
Aug 15, 2026
Researchers reported that the **Necro** botnet—also tracked as **N3Cr0m0rPh**, **FreakOut**, and **Necromorph**—rapidly evolved from an older Python malware family into an active cross-platform campaign targeting both Linux and Windows systems. Multiple reports tied the operation to exploitation of public-facing flaws including `CVE-2020-28188`, `CVE-2021-3007`, and `CVE-2020-7961`, with later variants adding more n-day exploits such as those affecting TerraMaster, Genexis, Xinuos OpenServer, Zeroshell, and **Visual Tools DVR VX16 4.2.28.0**. The malware also spread through SSH and Telnet brute forcing, and researchers observed infection volumes ranging from hundreds of confirmed download attempts to estimates in the tens of thousands of compromised hosts. The botnet used **IRC-based command and control**, later strengthened with **DGA-generated domains**, **Tor**, **SSL-encrypted communications**, polymorphic code, and PyInstaller-packed binaries to improve resilience and execution. Once installed, Necro enabled **DDoS attacks, reverse shells, persistence, traffic sniffing, ARP poisoning, lateral movement, file infection, and JavaScript injection**, while monetizing access primarily through **XMRig-based Monero mining** and, in some cases, Tezos mining. Cisco Talos also observed a Windows user-mode rootkit and a one-off apparent ransomware delivery attempt, underscoring that the operators were actively adding new payloads and exploit paths as the campaign matured.
Aug 15, 2026