Infosecurity
New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks
Part of the Turla story · since 19 Sep 2025
- Fri 19 Sep, 08:56 UTC. The Hacker News, first report. Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine.
- Fri 19 Sep, 10:35 UTC. GBHackers, its first report on the story. Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor.
- Fri 19 Sep, 13:45 UTC. SecurityWeek, its first report on the story. Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions.
- Sun 21 Sep, 18:15 UTC. Security Affairs, its first report on the story. ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks.
- Thu 14 May, 15:10 UTC. Microsoft, its first report on the story. Secret Blizzard’s Kazuar malware hits govts with P2P botnet.
- Fri 15 May, 17:50 UTC. The Hacker News. Turla’s Kazuar backdoor now powers stealthy peer to peer botnet.
- Sat 16 May, 17:16 UTC. Security Affairs. Russian Turla Group Deploys P2P Kazuar Botnet for Stealth.
- Thu 25 Jun, 15:32 UTC. Google Cloud, its first report on the story. Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe.
- Fri 26 Jun, 08:32 UTC. The Hacker News. Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine.
- Fri 26 Jun, 09:10 UTC. SecurityWeek. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets.
- Tue 30 Jun, 08:21 UTC. SecurityOnline, its first report on the story. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
- Wed 23 Sep, 14:38 UTC. Infosecurity, its first report on the story. New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks. This article, 12th of 15.
- Tue 10 Nov, 11:30 UTC. The Hacker News. Turla uses Cereal malware to steal emails from Exchange servers.
- Tue 10 Nov, 13:30 UTC. Dark Reading, its first report on the story. AI Makes Reverse Engineering Software and Malware Easier.
- Tue 10 Nov, 15:00 UTC. Infosecurity. Turla spies on NATO and EU emails through Exchange servers.
A previously undocumented Windows botnet called x47.c is being advertised with 18 attack methods, including a feature intended to exhaust victims’ paid AI credits. Qrator Research Labs reported on 23 September 2026 that the malware’s seller, WraithTools, promotes credential theft, SOCKS5 proxying and an AI-assisted persistence module.
The research was based on the seller’s advertisement, technical documentation, control-panel screenshots and follow-up messages; it does not establish that every advertised capability has been used in attacks.
The “AI API drain” command accepts a valid API key for OpenAI, xAI or a compatible chat API and sends repeated billable requests directly to the provider. Qrator described this as a denial-of-wallet attack: a victim’s website may remain operational while its underlying AI service consumes available credit. The seller reportedly marketed it against chatbots, AI-connected content management systems, trading bots and scanners, including for attacks on competitors.
Qrator said the cost depends on the account’s permitted overspend, and noted that anyone with a valid key could automate similar abuse. However, the documentation did not show that AI-site tokens stolen by the botnet are converted into API keys for this purpose.
Other advertised functions include HTTP, TCP and UDP floods, slow HTTP connections, TLS stress and reflection or amplification attacks, although Qrator found no test evidence supporting the claimed protection-bypass modes. The malware reportedly targets browser passwords, cookies and Discord tokens, while its “AI Stealth” feature uses Grok to select predefined persistence and concealment actions, including Windows Defender exclusions. An advertisement dated 3 August priced the botnet at $200–$950.
Qrator recommended revoking exposed AI keys, reviewing billing, setting spending limits and controlling automatic top-ups, alongside endpoint remediation and application- and network-layer DDoS protection.
How the story developed
15 articles from 9 outlets since 19 Sep. Picked up again today after 7 weeks quiet. This was the 12th report, 369 days after the first.
- Fri 19 Sep, 08:56 UTC. The Hacker News, first report. Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine.
- Fri 19 Sep, 10:35 UTC. GBHackers, its first report on the story. Russian Hacking Groups Gamaredon and Turla Target Organizations to Deliver Kazuar Backdoor.
- Fri 19 Sep, 13:45 UTC. SecurityWeek, its first report on the story. Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions.
- Sun 21 Sep, 18:15 UTC. Security Affairs, its first report on the story. ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks.
- Thu 14 May, 15:10 UTC. Microsoft, its first report on the story. Secret Blizzard’s Kazuar malware hits govts with P2P botnet.
- Fri 15 May, 17:50 UTC. The Hacker News. Turla’s Kazuar backdoor now powers stealthy peer to peer botnet.
- Sat 16 May, 17:16 UTC. Security Affairs. Russian Turla Group Deploys P2P Kazuar Botnet for Stealth.
- Thu 25 Jun, 15:32 UTC. Google Cloud, its first report on the story. Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe.
- Fri 26 Jun, 08:32 UTC. The Hacker News. Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine.
- Fri 26 Jun, 09:10 UTC. SecurityWeek. Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets.
- Tue 30 Jun, 08:21 UTC. SecurityOnline, its first report on the story. STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits. Cites a CVE in CISA KEV.
- Wed 23 Sep, 14:38 UTC. Infosecurity, its first report on the story. New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks. This article, 12th of 15.
- Tue 10 Nov, 11:30 UTC. The Hacker News. Turla uses Cereal malware to steal emails from Exchange servers.
- Tue 10 Nov, 13:30 UTC. Dark Reading, its first report on the story. AI Makes Reverse Engineering Software and Malware Easier.
- Tue 10 Nov, 15:00 UTC. Infosecurity. Turla spies on NATO and EU emails through Exchange servers.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Coverage over time
- Quiet time, folded
Show all 15 articles as a listHide the list
- Fri 19 SepDay 03
- Russian Hackers Gamaredon and Turla Collaborate to Deploy Kazuar Backdoor in Ukraine08:56 · The Hacker News · First report
- Turla and Gamaredon Working Together in Fresh Ukrainian Intrusions13:45 · SecurityWeek
Quiet for 2 days
Sun 21 SepDay 21- ESET uncovers Gamaredon–Turla collaboration in Ukraine cyberattacks18:15 · Security Affairs · Picked up again
Quiet for 34 weeks
Thu 14 MayDay 2371- Secret Blizzard’s Kazuar malware hits govts with P2P botnet15:10 · Microsoft · Picked up again
- Fri 15 MayDay 2381
- Turla’s Kazuar backdoor now powers stealthy peer to peer botnet17:50 · The Hacker News
- Sat 16 MayDay 2391
- Russian Turla Group Deploys P2P Kazuar Botnet for Stealth17:16 · Security Affairs
Quiet for 6 weeks
Thu 25 JunDay 2791- Google flags Turla’s STOCKSTAY backdoor aimed at Ukraine, Europe15:32 · Google Cloud · Picked up again
- Fri 26 JunDay 2802
- Google uncovers Turla's STOCKSTAY backdoor targeting Ukraine08:32 · The Hacker News
- Russian APT Deploys ‘StockStay’ Backdoor Against Ukrainian Targets09:10 · SecurityWeek
Quiet for 4 days
Tue 30 JunDay 2841- STOCKSTAY malware hits Ukraine, Italy via phishing RDP exploits08:21 · SecurityOnline · Exploited CVE · Picked up again · Known exploited CVE
Quiet for 12 weeks
Wed 23 SepDay 3691- New Windows Botnet Targets Victims’ AI Credits in ‘Denial-of-Wallet’ Attacks14:38 · Infosecurity · Picked up again · This article, 12th of 15
Quiet for 7 weeks
Tue 10 NovDay 4173- Turla uses Cereal malware to steal emails from Exchange servers11:30 · The Hacker News · Picked up again
- AI Makes Reverse Engineering Software and Malware Easier13:30 · Dark Reading
- Turla spies on NATO and EU emails through Exchange servers15:00 · Infosecurity