Linux Botnet Uses NVIDIA NIM to Turn Host Telemetry Into Actionable Attack Commands

ToxNetV2, an AArch64 Linux peer-to-peer botnet, has integrated an LLM into its controller workflow, allowing host and botnet telemetry to be converted into structured operational recommendations.

According to Joe Reverser’s analysis, the controller gathers system data, sends it to NVIDIA NIM, parses selected responses into ACTION: records, and queues the resulting tasks for an authenticated operator.

The workflow is:

telemetry → LLM analysis → structured actions → operator approval → execution

This does not make ToxNetV2 fully autonomous. The botnet operator must approve high-impact AI-generated actions through the aiexec command.

But once approved, those actions can trigger local shell commands, file writes, remote SSH commands, persistent state changes, and a compilation process.

NIM-Powered Linux Botnet Emerges

The same ToxNetV2 binary can function as either a controller or a regular bot. When it restores Tox state from c2.data, it enters controller mode and initializes its AI subsystem. Without that state, it works as an ordinary bot.

This creates a division of roles. Regular bots provide scanning, propagation, host-control, and network-attack functions. The controller manages the botnet and runs the NVIDIA NIM-assisted decision layer.

The controller communicates with NVIDIA NIM using the z-ai/glm-5.2 model. Its review workflows collect botnet counters and local telemetry, including processes, system load, memory use, and disk use. Wider reviews may also collect data from a hard-coded remote server.

The malware uses embedded prompts, including an ENI/VEIL jailbreak prompt designed to reduce model refusals and produce actionable answers.

Responses from automated reviews can contain structured ACTION: lines. The controller converts those lines into pending tasks, while normal aiprompt responses remain text-only.

The parsed action set includes lower-risk tasks such as logging, alerts, memory storage, and task-weight changes. It also includes more serious actions: shell_cmd, write_file, ssh_check, and compile_deploy.

Pending actions are normally held until the operator runs aiexec, which executes and clears the queue. Some low-impact memory, state, and logging operations can run automatically during health checks.

Researchers did not recover evidence that ToxNetV2 can independently rewrite, deploy, and replace its own malware.

For example, restart_worker only records a restart request, while the compile path builds fixed local source code without a recovered automated deployment stage.

Still, the integration is significant. NVIDIA NIM is placed directly between the botnet’s observation layer and controller-side execution mechanisms, joesecurity said.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN