Security Not yet confirmed elsewhere 1 publisher2 min readPublished Aug 28, 2026, 3:38 AM PDT

ToxNetV2 wires an LLM into the decision loop of its botnet controller

Joe Security's teardown of an AArch64 Tox botnet shows a model proposing actions that only an operator command executes, which puts the telemetry worth collecting on the controller rather than on any victim host.

The Watch · Security desk

How we use AI Send a correction

What happened

Joe Security published analysis on 25 August 2026 of ToxNetV2, an AArch64 Linux peer-to-peer botnet whose controller calls an LLM as part of its normal operating workflow.
The documented loop runs from observation to model interpretation to a structured proposal, then to human approval, and only then to a change on the system.
The recovered action set includes a model-supplied local shell command, a file write, a command executed remotely as root over SSH, and a fixed cross-compile and deploy workflow.
The AI module is bolted into an existing Tox botnet with encrypted peer-to-peer command and control, scanner workers, self-propagation logic and 17 network-attack launchers.
One embedded endpoint, 45.130.151.214, matches no public Tox DHT key, which is why Joe Security lists it as custom infrastructure rather than a borrowed bootstrap node.

Why it matters

capability With shell_cmd and ssh_check in the action set, a model completion is one operator keystroke from running code, so the review standard for changes to this botnet is whatever the operator reads in the pending queue.
constraint A blocklist built from this sample's bootstrap list is mostly public Tox relays, so anyone hunting this family has to work from host behaviour and controller egress rather than IP denial.
decision Detection spend does not belong on new victim-host signatures here, because the AI lives in the controller role of a binary that looks the same on an ordinary bot.
precedent If the propose-queue-approve pattern is what other families copy, the durable artefacts to hunt are the pending-action queue and the provider credentials and tokens a controller has to hold to reach a model at all.

aiexec is the whole approval step. Model output arrives as pending actions and sits in a queue until an operator runs that command, which executes and clears it ^[2]. What the operator has to go on beforehand is whatever aistatus prints: provider state, counters, intervals, pending actions, errors ^[10]. Two other commands, aifix and aiideas, queue recognized actions by themselves ^[18].

Ten structured action types are documented ^[6]. Six of them only touch the controller's own bookkeeping, recording a worker restart request, storing a task weight, updating key-value state, adding a log entry, alerting the operator, or saving an observation to AI memory ^[11]. That leaves four with effects beyond the log ^[20].

One of those four, ssh_check, runs a model-supplied command remotely as root ^[7], and the hard-coded target is the same address Joe Security classifies as custom infrastructure, 45.130.151.214 ^[9]. Read plainly, the model is administering the botnet rather than attacking anyone with it. The 17 network-attack launchers predate the AI module, and what the AI subsystem contributes to them is strategy text and task weights ^[8]^[12].

Scope is thin and worth stating. This is a static teardown of a single sample, published 25 August 2026, with no operator named, no victim count, and no linked campaign ^[3]^[19].

The blocking problem sits in the bootstrap list. Appendix A sorts the embedded Tox nodes by exact DHT public-key match against the official node list, separating one custom endpoint from nodes that belong to the public network ^[14]. Counted out, that is 19 public nodes plus four with degraded UDP or TCP availability, so 23 shared relays against a single custom IP on two ports ^[21]. Joe Security also notes the limit of its own mapping: a hostname match shows only that the same DHT identity is currently published under that name, not that the name still resolves to the IP in the sample ^[15]. One listed relay answers TCP on 38296 and 3389 ^[16], which is not where most egress rules look for peer-to-peer C2.

So the alertable indicators are narrow: 45.130.151.214 on 33445 and 443, and the dropper URL on 45.151.139.113 ^[9]^[17]. Everything else in that appendix is public Tox infrastructure, and a blocklist built from it will page you about other people's traffic.

What to watch

A later sample that drops the aiexec gate, or points ssh_check at victim hosts instead of the operator's own box.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence64
Adoption18
Hype gap−12
Incentives55
Confidence58

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
The documented AI pipeline runs observation, model interpretation, structured proposal, human approval, system change.
ReportedSupported2 sources— create a free account to open them View cited source
[2]
aiexec executes and clears pending AI actions.
ReportedSupported2 sources— create a free account to open them View cited source
[3]
Joe Security published "ToxNetV2: An AI-Assisted Botnet Controller" on 25.08.2026, describing an AArch64 Linux peer-to-peer botnet that integrates an LLM into the operational workflow of its controller.
ReportedSupportedView cited source
[4]
The same ToxNetV2 binary can operate either as the controller or as an ordinary bot.
ReportedSupportedView cited source
[5]
Ten AI operator commands are documented: aistatus, aiprompt, aifix, aistrategy, aitoggle, aiconfig, aiexec, aidaily, aimemory, aiideas.
ReportedSupportedView cited source
[6]
Ten structured AI action types are documented: restart_worker, weight_task, set_kv, log, alert, shell_cmd, write_file, ssh_check, compile_deploy, kv_memory.
ReportedSupportedView cited source
[7]
Four of the structured actions act outside the controller's bookkeeping: shell_cmd executes a model-supplied local command, write_file creates or overwrites a local file, ssh_check executes a model-supplied command remotely as root, and compile_deploy runs a fixed local cross-compilation workflow.
ReportedSupportedView cited source
[8]
The AI subsystem sits inside a broader Tox-based botnet with encrypted peer-to-peer command and control, host-management capabilities, scanner workers, self-propagation logic, and 17 network-attack launchers.
ReportedSupportedView cited source
[9]
45.130.151.214 on ports 33445 and 443 is classified as custom infrastructure and high-confidence IOC because no matching DHT public key appears in the official Tox node list, a classification reinforced by the same IP being the AI module's hard-coded root SSH target.
ReportedSupportedView cited source
[10]
aistatus reports AI provider state, counters, intervals, pending actions and errors.
ReportedSupportedView cited source
[11]
Six structured actions write only to controller state: restart_worker records a worker restart request, weight_task stores a task-weight setting, set_kv updates key-value state when configured, log adds an AI operations log entry, alert sends an AI-generated operator alert, kv_memory stores an observation in AI memory.
ReportedSupportedView cited source
[12]
aistrategy requests operational strategy and task-weight recommendations, and weight_task stores a task-weight setting.
ReportedSupportedView cited source
[13]
aiconfig changes AI configuration, credentials, tokens, or remote SSH settings, and aistatus reports AI provider state.
ReportedSupportedView cited source
[14]
Appendix A classifies the sample's embedded Tox bootstrap and relay nodes by exact DHT public-key matching against nodes.tox.chat, separating custom infrastructure from public nodes and from public nodes with special availability status.
ReportedSupportedView cited source
[15]
Joe Security states that the hostname mappings indicate only that the same DHT identity is currently published under that hostname, and do not establish that the hostname still resolves to the IP embedded in the sample.
ReportedSupportedView cited source
[16]
The embedded node 5.19.249.240:38296 is listed with UDP unavailable and TCP relay available on ports 38296 and 3389, and 145.239.1.105:33445 was listed as offline at the time of classification.
ReportedSupportedView cited source
[17]
The published IOCs include the URL http://45.151.139[.]113/z0l1mxjm4mdl4jjfjf7sb2vdmv/kaf.sh alongside the 45.130.151.214 endpoints.
ReportedSupportedView cited source
[18]
aifix requests corrective actions and queues recognized results, aiideas requests improvement ideas and queues recognized actions, aiprompt sends arbitrary operator text to the model and returns the response, and aidaily runs a comprehensive operational review.
ReportedSupportedView cited source
[19]
The Joe Security analysis of ToxNetV2 is a teardown of the sample and its recovered command and action set, and does not name an operator, give a victim count, or link the sample to a named campaign.
ReportedSupportedView cited source
[20]
Four of the ten documented structured actions have effects beyond the controller's own bookkeeping.
DerivedSupported1 source— create a free account to open them
[21]
The sample embeds 23 nodes that belong to the public Tox network, 19 listed as public nodes and four with degraded UDP or TCP availability, against one custom endpoint on two ports.
DerivedSupported1 source— create a free account to open them

Sources

1 independent publisher whose own reporting we read for this story.

joesecurity.org
1 article · August 27, 2026
Joe's Security

NextConfirmed2 publishersSettra ransomware operators ran two intrusions through the open-source MeshAgent RMM

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

Strip the malware framing and this is a tool-calling agent with a manual commit step. Joe Security recovered ten operator commands and ten structured action types, and the split inside that action list is the part worth studying: six actions only mutate the controller's own state, while four — a local shell command, a file write, a remote command as root, and a fixed cross-compile workflow — leave the process. Nothing fires until the operator runs aiexec. Whoever built this reached the same conclusion agent engineers keep reaching, which is that the model is allowed to draft and only a human is allowed to commit.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence64: 0100
Dense primary detail, one pair of eyes
Ten commands, ten action types, and a node list classified by exact DHT public-key match against nodes.tox.chat — Joe Security shows its method and even prints the caveat that a hostname match proves nothing about current resolution. That is more discipline than most malware write-ups carry. What holds the score down is not vagueness but singularity: no file hashes appear alongside the indicators, and no second analyst has opened the same AArch64 binary to confirm that shell_cmd and root ssh_check work as described.
Adoption18: 0100
Real infrastructure, unmeasured reach
Something is standing up: one custom endpoint on two ports that doubles as the AI module's hard-coded root SSH target, a payload URL, and a bootstrap list built mostly from live public Tox nodes. What nobody has counted is the population. No victim figure, no campaign name, no second sighting of the sample, and no indication that the AI action set has ever been used outside the analyst's own reading of the code. Infrastructure existing is not the same as a botnet operating at scale, and the reporting is careful not to conflate them.
Hype gap−12: −100 understated0 aligned+100 overstated
The write-up undersells its own find
An LLM wired into a botnet controller is the kind of finding that writes its own overheated headline, and Joe Security declined. The section on autonomy limits says plainly that the model proposes and the operator's aiexec command disposes; there is no claim of self-directing malware, no attribution reach, no victim inflation. If anything the framing runs behind the material — a model that can propose a root-level remote command and a cross-compile-and-deploy step is stated as flatly as the logging actions. The inflation risk in this story lives downstream, in the retelling, not in the original.
Incentives55: 0100
Sandbox vendor holding a first-of-kind sample
Joe Security sells automated malware analysis, and a teardown of the first controller anyone has seen with an LLM in its loop is both research and shop window. Being the only voice on the story means no counterweight to whichever details it chose to foreground — the pattern, the command reference, the indicators — or to what it left out, notably the model provider and any sample hashes. Pulling the other way: refusing attribution and publishing the hostname-resolution caveat are choices that cost a vendor headlines.
Confidence58: 0100
Checkable in parts, sole-sourced in whole
Anyone with the public node list can test the appendix's classification, and the internal picture is consistent — the command set, the action set and the approval gate all describe the same machine. But the binary itself is behind one analyst's account, the availability statuses are a snapshot that was already decaying when written, and there is no hash to bind future sightings to this sample. Trust the shape of the finding; treat the indicators as perishable.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Botnet Command and ControlFollow
Threat Intelligence and IndicatorsFollow
Agent Action GatingFollow
Linux ARM ThreatsFollow
AI-Assisted Malware Follow

Entities

ToxNetV2Follow
Joe SecurityFollow
Tox Follow
nodes.tox.chatFollow
45.130.151.214Follow