CyberNew CyberNew
Ransomware & Malware SecurityWeek 2 weeks ago

New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining

CN
CyberNew Threat Research Desk
• Original Reporting: SecurityWeek
CyberNew Threat Intel Assessment
Assessed Severity: MEDIUM
Impacted Surface
Cloud & Distributed Infrastructure
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"A threat actor has been selling access to a new Windows botnet that relies on AI to maintain persistence on infected hosts, Qrator reports. Dubbed x47.c , it is advertised by a threat actor named WraithTools as providing distributed denial-of-service (DDoS) and credential theft capabilities, SOCKS5 proxies, and an AI API drain method. In early August, the threat actor offered the botnet’s base..."

Recommended Defense & Mitigation

  • Threat Monitoring: Ingest published IOCs into SIEM/EDR detection rules for continuous telemetry monitoring.
  • Security Awareness: Alert staff and maintain baseline endpoint hardening across endpoints.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)
Botnet

A threat actor has been selling access to a new Windows botnet that relies on AI to maintain persistence on infected hosts, Qrator reports.

Dubbed x47.c, it is advertised by a threat actor named WraithTools as providing distributed denial-of-service (DDoS) and credential theft capabilities, SOCKS5 proxies, and an AI API drain method.

In early August, the threat actor offered the botnet’s base package for $200 and asked $150 for the DDoS add-on. The entire x47.c package, containing the full botnet capabilities, was priced at $950. 

Users are provided with a command-and-control (C&C) panel that provides access to bot management, fast-flux configuration options, information stealer logs, proxies, concealment capabilities, and DDoS attack options.

The panel’s DDoS tab provides access to 18 attack methods, including HTTP floods, AI API draining, slow HTTP, TCP and UDP floods, TLS stresser, and various reflection and amplification techniques.

While the HTTP, TCP, and UDP methods are meant to exhaust resources and bandwidth, the AI drain mode is meant to consume a victim’s paid AI credits.

Advertisement. Scroll to continue reading.

The operator supplies a model name and a valid API key for the targeted account on OpenAI, xAI, and compatible chat APIs to consume credits or incur charges.

“Because those requests go straight to the provider, they do not need to pass through the victim’s application. The website can remain reachable while the account behind its AI features runs out of credits,” Qrator notes.

Written By Ionut Arghire

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from SecurityWeek.

Primary Advisory →