Windows Botnet x47.c Offers AI API Draining, 18 Attack Methods
New Windows botnet 'x47.c' offers 18 attacks, including a novel method to drain victims' paid AI API credits.
Qrator Research Labs has documented a new Windows botnet called x47.c, sold by threat actor WraithTools. The botnet's most notable feature is an 'AI API drain' command that can exhaust a victim's paid AI service credits (e.g., OpenAI, xAI) by sending repeated billable requests directly to the provider. The malware also offers DDoS, credential theft, SOCKS5 proxying, and an 'AI Stealth' module that uses the Grok model to automate persistence and evasion on infected hosts.
- A new Windows botnet 'x47.c' offers 18 attack methods, including AI API credit draining.
- The 'AI API drain' attack sends repeated billable requests to exhaust a victim's paid AI credits.
- The botnet includes DDoS, credential theft, SOCKS5 proxying, and an 'AI Stealth' persistence module.
- The 'AI Stealth' module uses xAI's Grok to choose persistence and evasion actions.
- The malware is sold as a service, with prices ranging from $200 to $950.
- ATT&CK
- T1499 Endpoint Denial of ServiceT1040 Network SniffingT1555 Credentials from Password StoresT1550 Use Alternate Authentication Material
- Products
- Windows
- Threat actors
- WraithTools
- Malware
- x47.c
- Organizations
- Qrator Research Labs
- AI models
- Grok
From the original article
2 min read at infosecurity-magazine.com
Qrator found a Windows botnet advertised with AI API draining, credential theft and SOCKS5 proxying
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.