Researchers describe botnet controller using an LLM to select actions for infected hosts

Researchers described an AArch64 Linux peer-to-peer botnet, ToxNetV2, whose controller sends host and botnet telemetry to NVIDIA NIM using the z-ai/glm-5.2 model. According to the report summarized by The Hacker News, the controller parses model responses into structured actions and queues them for operator approval. Approved actions can reach local command execution, file writes, remote SSH, persistent state and a compilation workflow. The report says the system is not fully autonomous or self-modifying.