ToxNetV2: AI-Assisted Peer-to-Peer Botnet Controller Analysis

ToxNetV2 represents an evolutionary step in botnet architecture by integrating Large Language Models (LLMs) directly into its Command and Control (C2) workflow. Discovered by Joe Security in August 2026, the malware operates as an AArch64 Linux P2P botnet using the Tox protocol. The controller collects real-time fleet telemetry—including system load, process states, and network counters—and forwards this context to NVIDIA NIM (specifically the z-ai/glm-5.2 model) to generate structured operational recommendations.

Technically, the botnet functions through an 'operator-gated' AI layer. While the LLM identifies strategic targets and proposes actions such as shell command execution, remote SSH interaction, and local cross-compilation, a human operator must typically authorize these high-impact tasks. The malware utilizes a wide array of exploits for propagation, including critical vulnerabilities in Drupal (Drupalgeddon 2) and various IoT devices from D-Link, Zyxel, and Huawei.

This integration is significant because it reduces the cognitive load on operators and increases the speed at which a botnet can react to environmental changes. While not fully autonomous, the placement of an LLM between observation and action indicates a trend toward more intelligent, adaptive malware infrastructure. The use of custom Tox infrastructure (45.130.151[.]214) highlights the attacker's reliance on private P2P relay nodes to evade standard DHT tracking.