# ToxNetV2: AI-Assisted AArch64 Linux P2P Botnet Controller Using NVIDIA NIM LLM

> Joe Security analyzed ToxNetV2, an AArch64 Linux peer-to-peer botnet that communicates over the Tox protocol and whose controller mode feeds fleet telemetry to an NVIDIA NIM-hosted LLM (z-ai/glm-5.2). Model output is parsed into structured ACTION records that are queued for operator approval; the AI layer is operator-gated, not autonomous.

- **Published:** 2026-10-19T06:25:14Z
- **Last reviewed:** 2026-10-19T06:25:14Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3859
- **ID:** TL-2026-3859
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2018-10561, CVE-2018-10562, CVE-2014-8361, CVE-2017-17215, CVE-2016-10372, CVE-2015-2051, CVE-2016-20016, CVE-2013-7471, CVE-2018-7600, CVE-2022-30525, CVE-2021-36260, CVE-2017-17562, CVE-2020-10987, CVE-2024-3272, CVE-2024-3273

## Description

ToxNetV2 is a single AArch64 Linux binary that runs either as a standard bot or as the botnet controller, depending on whether it restores Tox state from a c2.data file. Command and control uses the Tox peer-to-peer encrypted protocol, bootstrapped through 23 embedded public Tox DHT nodes plus actor-associated endpoints 45.130.151.214:33445 and 45.130.151.214:443. Joe Security identified the sample with its Joe Reverser tool and published the analysis on 2026-08-25.

Only the controller initializes the AI subsystem and runs the automated AI review loop. The loop is: telemetry collection (running processes, CPU load, memory, disk activity, network counters) -> LLM analysis via NVIDIA NIM using the z-ai/glm-5.2 model -> parsing of responses into structured ACTION records -> queuing for operator approval -> execution. The prompts embed ENI/VEIL jailbreak instructions intended to suppress model refusals. Structured actions are restart_worker, weight_task, set_kv, log, alert, shell_cmd, write_file, ssh_check, compile_deploy and kv_memory. Operator-authenticated AI commands are aistatus, aiprompt, aifix, aistrategy, aitoggle, aiconfig, aiexec, aidaily, aimemory and aiideas; the controller also exposes help, ping, list, names, stats, exec, mass and masslinux. Per Joe Security, certain low-risk actions may run without confirmation, while high-impact actions require explicit confirmation from an authenticated operator (via aiexec); no mechanism for independent code rewriting, compilation or distribution without operator involvement was found. Joe Security characterizes the defensible finding as narrow: LLM output sits between operational telemetry and real controller-side execution mechanisms.

Bot-side functionality includes scanner controls (startscan, stopscan, starttelnet, startssh, startkiller, startlocker), a 'brick' wiper command, and 17 network-attack launchers (including VSE, WRA, UDP/TCP variants, RakNet, OpenVPN and a 'Brazilian Handshake' flood). Propagation over HTTP, Telnet and SSH targets internet-facing routers, DVRs, NAS devices and web applications using 15 named, long-patched CVEs (Dasan GPON, Realtek SDK, Huawei HG532, TR-064, D-Link HNAP/WANIPConn/NAS, MVPower DVR, Drupalgeddon 2, Zyxel ZTP, Hikvision, GoAhead, Tenda AC15) plus several unattributed injection exploits (Netgear setup.cgi, D-Link language injection, generic CGI semicolon injection, board.cgi, login newline injection, AJAX execution, RPC2 session injection, firmware-upgrade injection, stok injection). A dropper script is retrieved from http://45.151.139.113/z0l1mxjm4mdl4jjfjf7sb2vdmv/kaf.sh.

No threat actor, CVSS score or sample hashes are stated in the sources, and findings rest chiefly on a single vendor report with secondary coverage. BeaconBeagle returned no record (HTTP 404) for 45.130.151.214 or 45.151.139.113 at research time.

## MITRE ATT&CK

- T1595.002 Vulnerability Scanning
- T1584.008 Network Devices
- T1190 Exploit Public-Facing Application
- T1059.004 Unix Shell
- T1046 Network Service Discovery
- T1021.004 SSH
- T1071.001 Web Protocols
- T1573.002 Asymmetric Cryptography
- T1485 Data Destruction
- T1561 Disk Wipe
- T1110 Brute Force
- T1057 Process Discovery
- T1082 System Information Discovery
- T1095 Non-Application Layer Protocol
- T1571 Non-Standard Port
- T1059 Command and Scripting Interpreter

## Sources

- [ToxNetV2: An AI-Assisted Botnet Controller (Joe Security)](https://www.joesecurity.org/blog/6764463444623599134)
- [Cyber Security News: ToxNetV2 Linux botnet](https://cybersecuritynews.com/toxnetv2-linux-botnet/amp/)
- [SecurityOnline: ToxNetV2 botnet AI integration](https://securityonline.info/toxnetv2-botnet-ai-integration/)
- [detections.ai: ToxNetV2 AI-Assisted Peer-to-Peer Botnet Controller Analysis](https://detections.ai/intel-exchange/01a04467-b4aa-715c-8f8b-45b0bf6cee16)
- [ThreatCluster: ToxNetV2 botnet leverages AI](https://threatcluster.io/cluster/toxnetv2-botnet-leverages-ai-for-advanced-cyber-attacks-57ab946b)
- [Let's Data Science: ToxNetV2 analysis shows an AI-assisted botnet controller](https://letsdatascience.com/news/toxnetv2-analysis-shows-an-ai-assisted-botnet-controller-f29b72f5)
- [SecurityLab.ru: Linux botnet ToxNetV2 entrusted server management to a language model](https://www.securitylab.ru/news/576644.php)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3859