Grok AI in a Botnet? Plus SharePoint Exploits, Exchange Updates & Ransomware

We do see a couple stories that came in about the Windows botnet situation.

People keep saying botnets are dead and don't need to use them.

Well, no, that's incorrect.

Botnets are still very much alive.

You know, one thing that people don't understand.

So if you're new to it, before I go into the story, a botnet really is a cluster of malware infected devices.

They could be your windows, your Mac.

A lot of times it's your IOT devices nowadays.

but they all beacon back to a central C2 command and control server.

And it's sending up a flag.

If you're in IT, especially in an ARM, an MSP scenario, Think of it much like your RMM.

So there is a health check or a heartbeat that is done.

And that's where a lot of times you start seeing what's called, especially in our industry called beaconing.

So you have an agent or a sense of malware or whatever that keeps beaconing.

to a fully qualified domain, nine times out of 10 is just an IP address, and saying, hey, I'm here, what do you got for me? Nothing, great, and goes back to sleep for a predetermined time.

Some of the more sophisticated botnets are completely randomized on the health check-in to obfuscate from beaconing detection.

So a little history on that.

But the first story coming in, we got two stories on the same topic.

I'm just gonna kind of mention this one here from security-magazine.com. A previously undocumented Windows botnet dubbed as x47.c was found offering 18 attack methods, including one designed to drain victims' paid API credits.

According to research published by QTAR Research Labs on September 23rd, the seller goes by the name of Rathhood Tools.

That's also a newer person on the breach forums.

Also offers credential theft, socks 5 proxy and an ai model meant to keep the malware on infected machines that's kind of going uh around the obfuscation and trying to randomize beaconing back to the command and control um the socks 5 is the ability to route through the Tor network, if you're unfamiliar with that.

QTAR findings are drawn from the seller's advertisement, technical documentation, panel screenshots, and follow-up messages.

Well, the rest of the article is kind of generic, things of that nature.

If we actually pivot back over here or pivot over to the securityweekly.com, where they kind of go in a little bit more stating that, you know, it does weaponize the XAI, which is Grok AI API draining data.