cyber.hendryadrian.com
Security News · securityweek.com

x47.c Windows Botnet Advertises AI-Powered Persistence, Credential Theft and AI-Credit Draining

· Original article ↗

Summary

Qrator reports that a threat actor is selling x47.c, a Windows botnet advertised with DDoS, credential theft, proxy and AI API-draining features. Its AI stealth module is promoted as using xAI Grok to help maintain persistence.

Key points

  • A threat actor named WraithTools reportedly offered x47.c packages for $200 to $950, with DDoS available as an add-on.
  • The botnet’s control panel reportedly includes bot management, fast-flux options, stolen-data logs, proxies and 18 DDoS methods.
  • Its AI API-draining mode uses a model name and valid API key to consume a target account’s credits or incur charges, without routing requests through the victim’s application.
  • The advertised AI stealth module uses xAI Grok to select persistence actions such as startup entries and scheduled tasks; local fallback actions are also described.
  • x47.c is advertised as able to steal browser passwords and cookies, Discord tokens, wallet data and AI-site tokens.
  • Operators can reportedly relay traffic through infected hosts using SOCKS5 and download, update or remove software on them.

Article Details

Event Type
A threat actor is selling access to x47.c, a Windows botnet advertised with DDoS, credential theft, proxy, and AI API credit-draining capabilities.
Impact
The botnet can maintain persistence on infected Windows hosts, steal passwords, cookies, Discord tokens, wallet data, and AI-site tokens, relay traffic through SOCKS5 proxies, and launch DDoS attacks. Its AI API drain mode can use a valid API key to consume credits or incur charges on targeted accounts. No specific victims or confirmed impact are reported.

MITRE ATT&CK

T1053 · Scheduled Task/JobThe AI stealth module is advertised as maintaining persistence through scheduled tasks.T1055 · Process InjectionOptional process hollowing capabilities are available.T1090 · ProxyThe botnet relays traffic through a SOCKS5 proxy module.T1498 · Network Denial of ServiceThe botnet is advertised as providing DDoS attacks, including HTTP, TCP, and UDP floods.T1546.012 · Image File Execution Options InjectionThe botnet's reported status messages include Windows Defender exclusions.T1547 · Boot or Logon Autostart ExecutionThe AI stealth module is advertised as maintaining persistence through startup entries.T1555.003 · Credentials from Web BrowsersThe botnet can harvest passwords and cookies from victims' browsers.

Threat Actors

WraithToolsNamed as the threat actor selling and advertising the x47.c botnet.

Malware

x47.cDubbed x47.c, it is advertised by a threat actor named WraithTools as providing distributed denial-of-service (DDoS) and credential theft capabilities, SOCKS5 proxies, and an AI API drain method.

Vendors

xAIThe operator supplies a model name and a valid API key for the targeted account on OpenAI, xAI, and compatible chat APIs to consume credits or incur charges.

Products

GrokIt is advertised as using xAI Grok to choose from a predefined list of actions, including startup entries and scheduled tasks.Microsoft WindowsA threat actor has been selling access to a new Windows botnet that relies on AI to maintain persistence on infected hosts, Qrator reports.OpenAIThe operator supplies a model name and a valid API key for the targeted account on OpenAI, xAI, and compatible chat APIs to consume credits or incur charges.Windows DefenderThe supplied status messages report startup changes, persistence repair, and Windows Defender exclusions.

Related Articles