# Researchers describe botnet controller using an LLM to select actions for infected hosts

_Thursday, August 27, 2026 at 11:12 AM EDT · Security, AI · Latest · Tier 2 — Notable_

![Researchers describe botnet controller using an LLM to select actions for infected hosts — Primary](https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwWCb2shFhaav60Wjr2-8DoStCVaQrYqkE6EBZ8F5sREap-Khi19y-w9NVmFHyHosV6xVB0fTeN_DcSpGIyCZ621SnjqZozRVG70ceOey_D8djA5r5rpP9tFkRSESgs4kHZilTMoz2y8uqX-iTLR0JjjZkhypYjCCAEvQKzyU7xarQpt3sYvJc-fnWSWlb/s1700-e365/threats.jpg)

Researchers described an AArch64 Linux peer-to-peer botnet, ToxNetV2, whose controller sends host and botnet telemetry to NVIDIA NIM using the z-ai/glm-5.2 model. According to the report summarized by The Hacker News, the controller parses model responses into structured actions and queues them for operator approval. Approved actions can reach local command execution, file writes, remote SSH, persistent state and a compilation workflow. The report says the system is not fully autonomous or self-modifying.

## Sources

- [The Hacker News](https://thehackernews.com/2026/08/threatsday-296k-iot-botnet-100-water.html)

---
Canonical: https://techandbusiness.org/newswire/dis6eoOEhqB9AToh8g_61X
Retrieved: 2026-08-27T20:53:45.265Z
Publisher: Tech & Business (techandbusiness.org)