Linux Botnet Uses NVIDIA NIM to Turn Host Telemetry Into Actionable Attack Commands

ToxNetV2 is an AArch64 Linux peer-to-peer botnet that embeds an NVIDIA NIM LLM in its controller to analyze host and botnet telemetry and generate structured ACTION tasks (including shell commands, file writes, SSH checks, and compilation). The AI-generated tasks are queued for operator approval via aiexec while regular bots perform scanning, propagation, and attacks; researchers recovered IOCs including 45.130.151.214 and 45.130.151.214:33445.