Threat reportMalwareTL-2026-3859

ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller Using NVIDIA NIM LLM

highACTIVE

ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller (TL-2026-3859), also tracked as ToxNetV2, is a high-severity malware campaign, first published 2026-10-19. It has no confirmed attribution, affects Dasan GPON home routers, references 15 CVEs (CVE-2018-10561, CVE-2018-10562, CVE-2014-8361), maps to 16 MITRE ATT&CK techniques (T1021.004, T1046, T1057), and is covered by 9 detection rules and 14 indicators of compromise.

Severity
HIGHAssessed severity
CVEs
15Referenced vulnerabilities
Techniques
16MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
14Indicators of compromise

Key facts for TL-2026-3859

Threat ID
TL-2026-3859
Also known as
ToxNetV2
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
Last reviewed
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
telecoms, technology, consumer-iot
Target regions
Global
Detection rules
9
Indicators of compromise
14

Malware and tooling in ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller

Malware and tooling: ToxNetV2, NVIDIA NIM, z-ai/glm-5.2

How ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller works

Joe Security analyzed ToxNetV2, an AArch64 Linux peer-to-peer botnet that communicates over the Tox protocol and whose controller mode feeds fleet telemetry to an NVIDIA NIM-hosted LLM (z-ai/glm-5.2). Model output is parsed into structured ACTION records that are queued for operator approval; the AI layer is operator-gated, not autonomous.

ToxNetV2 is a single AArch64 Linux binary that runs either as a standard bot or as the botnet controller, depending on whether it restores Tox state from a c2.data file. Command and control uses the Tox peer-to-peer encrypted protocol, bootstrapped through 23 embedded public Tox DHT nodes plus actor-associated endpoints 45.130.151.214:33445 and 45.130.151.214:443. Joe Security identified the sample with its Joe Reverser tool and published the analysis on 2026-08-25.

Only the controller initializes the AI subsystem and runs the automated AI review loop. The loop is: telemetry collection (running processes, CPU load, memory, disk activity, network counters) -> LLM analysis via NVIDIA NIM using the z-ai/glm-5.2 model -> parsing of responses into structured ACTION records -> queuing for operator approval -> execution. The prompts embed ENI/VEIL jailbreak instructions intended to suppress model refusals. Structured actions are restart_worker, weight_task, set_kv, log, alert, shell_cmd, write_file, ssh_check, compile_deploy and kv_memory. Operator-authenticated AI commands are aistatus, aiprompt, aifix, aistrategy, aitoggle, aiconfig, aiexec, aidaily, aimemory and aiideas; the controller also exposes help, ping, list, names, stats, exec, mass and masslinux. Per Joe Security, certain low-risk actions may run without confirmation, while high-impact actions require explicit confirmation from an authenticated operator (via aiexec); no mechanism for independent code rewriting, compilation or distribution without operator involvement was found. Joe Security characterizes the defensible finding as narrow: LLM output sits between operational telemetry and real controller-side execution mechanisms.

Bot-side functionality includes scanner controls (startscan, stopscan, starttelnet, startssh, startkiller, startlocker), a 'brick' wiper command, and 17 network-attack launchers (including VSE, WRA, UDP/TCP variants, RakNet, OpenVPN and a 'Brazilian Handshake' flood). Propagation over HTTP, Telnet and SSH targets internet-facing routers, DVRs, NAS devices and web applications using 15 named, long-patched CVEs (Dasan GPON, Realtek SDK, Huawei HG532, TR-064, D-Link HNAP/WANIPConn/NAS, MVPower DVR, Drupalgeddon 2, Zyxel ZTP, Hikvision, GoAhead, Tenda AC15) plus several unattributed injection exploits (Netgear setup.cgi, D-Link language injection, generic CGI semicolon injection, board.cgi, login newline injection, AJAX execution, RPC2 session injection, firmware-upgrade injection, stok injection). A dropper script is retrieved from http://45.151.139.113/z0l1mxjm4mdl4jjfjf7sb2vdmv/kaf.sh.

No threat actor, CVSS score or sample hashes are stated in the sources, and findings rest chiefly on a single vendor report with secondary coverage. BeaconBeagle returned no record (HTTP 404) for 45.130.151.214 or 45.151.139.113 at research time.

MITRE ATT&CK techniques used in TL-2026-3859

Lateral Movement

T1021.004 SSH

Discovery

T1046 Network Service Discovery; T1057 Process Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter; T1059.004 Unix Shell

Command and Control

T1071.001 Web Protocols; T1095 Non-Application Layer Protocol; T1571 Non-Standard Port; T1573.002 Asymmetric Cryptography

Credential Access

T1110 Brute Force

Initial Access

T1190 Exploit Public-Facing Application

Impact

T1485 Data Destruction; T1561 Disk Wipe

Resource Development

T1584.008 Network Devices

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller

  • Dasan — GPON home routers
    Vulnerable versions: CVE-2018-10561; CVE-2018-10562
  • Realtek — SDK miniigd UPnP service
    Vulnerable versions: CVE-2014-8361
  • Huawei — HG532 routers
    Vulnerable versions: CVE-2017-17215
  • D-Link — HNAP, WANIPConn1 and NAS devices
    Vulnerable versions: CVE-2015-2051; CVE-2013-7471; CVE-2024-3272; CVE-2024-3273
  • MVPower — DVR (JAWS web server)
    Vulnerable versions: CVE-2016-20016
  • Drupal — Drupal core
    Vulnerable versions: CVE-2018-7600
  • Zyxel — Firewall ZTP
    Vulnerable versions: CVE-2022-30525
  • Hikvision — Camera web server
    Vulnerable versions: CVE-2021-36260
  • GoAhead — GoAhead web server CGI
    Vulnerable versions: CVE-2017-17562
  • Tenda — AC15 router
    Vulnerable versions: CVE-2020-10987

Remediation for ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller

Patches

  • Apply vendor fixes for CVE-2018-7600 (Drupal), CVE-2022-30525 (Zyxel), CVE-2021-36260 (Hikvision), CVE-2024-3272/CVE-2024-3273 (D-Link NAS), CVE-2020-10987 (Tenda AC15) and the remaining listed CVEs where vendors still publish firmware
  • Retire devices affected by CVE-2018-10561, CVE-2018-10562, CVE-2014-8361, CVE-2017-17215, CVE-2016-10372, CVE-2015-2051, CVE-2016-20016, CVE-2013-7471 and CVE-2017-17562 if no fixed firmware exists

Immediate actions

  • Block outbound traffic to 45.130.151.214 (TCP 33445 and 443) and 45.151.139.113 at the perimeter
  • Hunt Linux AArch64 hosts and IoT/edge devices for a c2.data file, outbound Tox DHT bootstrap traffic to the embedded public node list, and downloads of kaf.sh
  • Isolate internet-facing routers, DVRs and NAS devices that show scanning or flood traffic on ports 80, 81, 443, 8080, 8443, 2031, 3389, 5555, 7574, 37215, 38296, 49152 or 52869

Workarounds

  • Disable UPnP, remote administration and TR-064 on WAN-facing interfaces
  • Place IoT devices in isolated VLANs with default-deny egress

Longer-term hardening

  • Remove management interfaces of consumer routers, DVRs and NAS devices from direct internet exposure
  • Egress-filter Tox protocol traffic and unexpected calls to LLM API endpoints (integrate.api.nvidia.com / NIM) from servers and embedded devices
  • Replace end-of-life network devices that cannot receive patches for the listed CVEs
  • Change default credentials on Telnet/SSH-enabled devices and disable Telnet

CVEs associated with ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller

Weaknesses (CWE) in ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller

CWE-78

Timeline of ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller

  • Drupal discloses CVE-2018-7600 (Drupalgeddon 2), one of the 15 n-day CVEs ToxNetV2 uses for propagation
  • CVE-2021-36260 (Hikvision camera web server command injection) published; later embedded among ToxNetV2 propagation exploits
  • CVE-2022-30525 (Zyxel firewall ZTP command injection) publicly disclosed; later embedded among ToxNetV2 propagation exploits
  • CVE-2024-3272 and CVE-2024-3273 (D-Link NAS) published; the most recent CVEs in ToxNetV2's exploit set
  • Joe Security publishes 'ToxNetV2: An AI-Assisted Botnet Controller', analyzed with Joe Reverser, documenting the NVIDIA NIM z-ai/glm-5.2 integration, 15 CVEs and network IOCs
  • SecurityOnline and other outlets report on ToxNetV2's operator-gated, LLM-assisted controller workflow
  • Platform research re-verified sources; BeaconBeagle returned no C2 record for 45.130.151.214 or 45.151.139.113, and no sample hashes had been published

Sources cited for ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller

Detection coverage for TL-2026-3859

As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3859 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
14 indicators of compromise · Red and above. Compare plans

Community OSINT corroboration for TL-2026-3859

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats