Dolphin X RAT advertises AI profiler to rank victims for attackers
Summary
Varonis analyzed Dolphin X’s operator panel, which advertises an AI profiler for ranking victims and credential theft targeting more than 300 applications. The capabilities were not verified on a live infected system.
Key points
- Varonis Threat Labs researcher Daniel Kelley analyzed the Dolphin X panel, builder, and network traffic, but did not execute a live agent on an infected computer.
- The operator panel advertises 329 features across ten categories, including credential theft targeting more than 300 applications.
- Dolphin X claims its AI Profiler can score and rank victims using information such as app usage, browser domains, and installed software.
- Technical strings in the panel support the presence of a profiling workflow, but Varonis could not identify the AI engine or verify the advertised collection capabilities on a live sample.
- The malware also claims to steal .env files, SSH keys, cloud access tokens, browser logins, and cryptocurrency wallet information.
Article Details
- Event Type
- Analysis of Dolphin X, a remote access trojan advertised with credential-stealing and AI-powered victim-profiling capabilities.
- Impact
- The operator panel advertises credential theft from more than 300 applications and victim ranking to help prioritize targets. Varonis analyzed the panel, builder, and related traffic but did not execute a live agent, so the advertised collection and profiling capabilities were not independently confirmed.