A threat actor has been selling access to a new Windows botnet that relies on AI to maintain persistence on infected hosts, Qrator reports.
Dubbed x47.c, it is advertised by a threat actor named WraithTools as providing distributed denial-of-service (DDoS) and credential theft capabilities, SOCKS5 proxies, and an AI API drain method.
In early August, the threat actor offered the botnet’s base package for $200 and asked $150 for the DDoS add-on. The entire x47.c package, containing the full botnet capabilities, was priced at $950.
Users are provided with a command-and-control (C&C) panel that provides access to bot management, fast-flux configuration options, information stealer logs, proxies, concealment capabilities, and DDoS attack options.
The panel’s DDoS tab provides access to 18 attack methods, including HTTP floods, AI API draining, slow HTTP, TCP and UDP floods, TLS stresser, and various reflection and amplification techniques.
While the HTTP, TCP, and UDP methods are meant to exhaust resources and bandwidth, the AI drain mode is meant to consume a victim’s paid AI credits.
The operator supplies a model name and a valid API key for the targeted account on OpenAI, xAI, and compatible chat APIs to consume credits or incur charges.
“Because those requests go straight to the provider, they do not need to pass through the victim’s application. The website can remain reachable while the account behind its AI features runs out of credits,” Qrator notes.
According to the botnet’s administrator, a fast flux configuration is used for maintaining control over the infected machines, offering six domains and eight IP addresses in the specific management tab, along with preferred hostname and IP options for individual hosts.
Additionally, x47.c has an “AI stealth” module for maintaining persistence on the infected systems. It is advertised as using xAI Grok to choose from a predefined list of actions, including startup entries and scheduled tasks. Optional process hollowing and privilege escalation capabilities are also available.
“The operator enables those calls by including an xAI key in the build. The supplied status messages report startup changes, persistence repair, and Windows Defender exclusions. They also show local fallback actions when a model call fails, allowing host maintenance to continue without a successful AI response,” Qrator explains.
The operator can select the bot’s DDoS targets and can download, update, and remove software from the host. x47.c’s administrator also promotes a rootkit module for removing rival artifacts from the infected systems.
Operators can use the botnet to collect credentials from the infected machines or to relay traffic through them. x47.c can harvest passwords and cookies from the victim’s browsers, and can collect Discord tokens, wallet data, and AI-site tokens.
Traffic is relayed through a SOCKS5 module, and the operator can monitor multiple proxy connections and check their health status and timeouts.
Related: AI-Powered Campaign Targets Hundreds of Online Retailers
Related: 23-Year-Old Sality P2P Botnet Disrupted
Related: Ukrainian Extradited to US Faces Charges in Jabber Zeus Cybercrime Case
Related: First Malware Built Specifically for Car Head Units Fuels Botnet