ToxNetV2 Linux Botnet Uses NVIDIA AI to Generate Shell and Remote SSH Attack Actions

Cybersecuritynews •Tushar Subhra Dutta • August 25, 2026

ToxNetV2 is a Linux botnet that shows how artificial intelligence can move closer to real attack operations. Instead of using a model only to write text, the malware feeds system and botnet data into an AI service, then turns selected replies into proposed commands. That design gives operators a faster way to judge what to […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ToxNetV2 Botnet Leverages AI for Advanced Cyber Attacks ToxNetV2 is a newly identified AArch64 Linux botnet that integrates a large language model from NVIDIA to enhance its operational capabilities. The botnet utilizes telemetry data from infected hosts to generate actionable commands for attacks, including local shell execution and remote SSH commands. This innovative approach allows operators to quickly assess and execute attack strategies based on real-time data. The botnet's architecture enables persistent state changes and cross-compilation, making it a versatile tool for cybercriminals. The integration of AI into botnet operations signifies a concerning evolution in malware tactics, potentially increasing the speed and effectiveness of cyber attacks. Current reports indicate that ToxNetV2 is actively being deployed, posing a significant threat to Linux-based systems. Security professionals are urged to monitor for unusual network activity and unauthorized access attempts. The full scope of the botnet's impact is still being evaluated. 2 sources 67

Extracted Entities

ToxNetV2 Linux Botnet Uses NVIDIA AI to Generate Shell and Remote SSH Attack Actions

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)