According to Qrator, a threat actor has sold access to a new Windows botnet that relies on AI to maintain persistence on infected hosts.
Synchronized x47.cit is promoted by a threat actor called WraithTools as a provider of distributed denial of service (DDoS) and credential theft capabilities, SOCKS5 proxies, and an AI API drain method.
In early August, the threat actor offered the botnet’s basic package for $200 and charged $150 for the DDoS add-on. The entire x47.c package with all botnet features cost $950.
Users are provided with a command and control (C&C) panel that provides access to bot management, fast flux configuration options, information theft protocols, proxies, obfuscation capabilities, and DDoS attack options.
The panel’s DDoS tab provides access to 18 attack vectors, including HTTP floods, AI API draining, slow HTTP, TCP and UDP floods, TLS stressers, and various reflection and amplification techniques.
While the HTTP, TCP and UDP methods are intended to drain resources and bandwidth, AI Drain mode is intended to drain a victim’s paid AI credits.
The operator provides a model name and a valid API key for the target account on OpenAI, xAI and compatible chat APIs to consume credits or collect fees.
“Because these requests go directly to the provider, they do not need to be routed through the victim’s application. The website can remain accessible while the account behind its AI functions runs out of funds,” notes Qrator.
According to the botnet administrator, a fast-flux configuration is used to maintain control over the infected machines. It provides six domains and eight IP addresses in the specific management tab, as well as preferred hostname and IP options for individual hosts.
Additionally, x47.c has an “AI stealth” module to maintain persistence on the infected systems. It is advertised as using xAI Grok to select from a predefined list of actions, including startup items and scheduled tasks. Optional process hollowing and privilege escalation features are also available.
“The operator enables these calls by including an xAI key in the build. The status messages provided report boot changes, persistence repairs, and Windows Defender exclusions. They also indicate local fallback actions if a model call fails, allowing host maintenance to continue without a successful AI response,” explains Qrator.
The operator can select the bot’s DDoS targets and download, update and remove software from the host. The x47.c administrator also promotes a rootkit module to remove competing artifacts from the infected systems.
Operators can use the botnet to collect credentials from the infected computers or route traffic through them. x47.c can collect passwords and cookies from victims’ browsers and collect Discord tokens, wallet data and AI site tokens.
Traffic is routed through a SOCKS5 module and the operator can monitor multiple proxy connections and check their health and timeouts.
Related: AI-powered campaign targets hundreds of online retailers
Related: 23-year-old Sality’s P2P botnet disrupted
Related: Ukrainian extradited to the US is charged in the Jabber Zeus cybercrime case
Related: First malware designed specifically for the Car Head Units Fuels botnet
