Linux Botnet Uses NVIDIA NIM to Turn Host Telemetry Into Actionable Attack Commands

ToxNetV2, an AArch64 Linux peer-to-peer botnet, has integrated an LLM into its controller workflow, allowing host and botnet telemetry to be converted into structured operational recommendations.

According to Joe Reverser’s analysis, the controller gathers system data, sends it to NVIDIA NIM, parses selected responses into ACTION: records, and queues the resulting tasks for an authenticated operator.

The workflow is:

telemetry → LLM analysis → structured actions → operator approval → execution

This does not make ToxNetV2 fully autonomous. The botnet operator must approve high-impact AI-generated actions through the aiexec command.

But once approved, those actions can trigger local shell commands, file writes, remote SSH commands, persistent state changes, and a compilation process.