x47.c is a previously undocumented Windows botnet advertised with 18 attack methods, credential theft, SOCKS5 proxies, and an AI module designed to help it remain on infected machines. Qrator Research Labs identified the offering, sold by WraithTools, during routine threat hunting.
One of the advertised methods, “AI API drain,” is designed to exhaust a victim’s paid AI credits. Using a valid API key, an operator can send repeated requests that consume the account’s balance or increase its bill. OWASP describes this type of attack as Denial of Wallet (DoW).
To understand how x47.c works, we reviewed its advertisement, technical documentation, panel screenshots, and follow-up messages from the seller. In this post, we break down the AI drain mode, the other DDoS methods, and the features intended to keep infected machines under an operator’s control.
The AI drain command starts with a valid API key for the account being targeted. For OpenAI, xAI, and compatible chat APIs, the operator supplies that key and a model name. The bot then sends requests directly to the provider; when accepted, these billable requests consume credits or generate charges.
Anyone with a valid key could also automate these requests using a script. What caught our attention was the x47.c seller explicitly advertising AI API draining as one of the botnet’s attack methods.
Because those requests go straight to the provider, they do not need to pass through the victim’s application. The website can remain reachable while the account behind its AI features runs out of credits. If the provider rejects further requests once the account balance is exhausted or an enforced limit is reached, legitimate users lose access to those features.
WraithTools describes using this method against applications that rely on paid AI services. In follow-up messages, the operator points to automatic top-ups as a way to keep generating charges even after the account’s initial balance is exhausted. The resulting cost depends on how much additional spending the account permits.
The targets suggested by the seller include chatbots, AI-connected content management systems, trading bots, and scanners. WraithTools also explicitly pitches the method as a service that buyers could use against competitors. In the documented implementation, however, targeting any of these services requires a valid AI API key for the account being charged.
AI API draining sits alongside a broader collection of DDoS methods implemented in x47.c. These give operators options for overwhelming web applications, holding connections open, and flooding network services from the same panel.
In an advertisement dated August 3, 2026, the seller, WraithTools, offers a $200 base package with a $150 DDoS add-on. The full $950 package also includes credential theft, SOCKS5 proxies, and AI-assisted persistence.
That panel is labeled “x47 Fast Flux C2GUI v4.1.” It separates bot management, fast-flux configuration, proxies, stealer logs, stealth activity, and DDoS into dedicated tabs.
From the DDoS tab, an operator selects the target and attack method. According to the documentation, each bot runs one attack at a time. The 18 listed methods include AI API draining, HTTP floods, slow HTTP connections, TCP and UDP floods, TLS connection stress, as well as several reflection and amplification techniques.
The HTTP methods are designed to consume application resources, including the server workers and connections needed to serve legitimate users. TCP and UDP floods can also put pressure on connection capacity or available bandwidth. The AI drain mode extends that resource exhaustion to the paid account supporting an application’s AI features.
Some methods depend on what the infected machine allows. The documented SYN mode uses raw sockets when the necessary support and privileges are available, then falls back to TCP connection attempts if they are not. We found no throughput measurements or test results supporting the advertised protection-bypass modes, so their effectiveness remains unclear.
The bots receive those attack instructions through a command-and-control (C2) server. To help them reconnect when a destination becomes unavailable, x47.c includes what WraithTools calls a “fast flux” configuration. Each bot remembers its last working destination and tries alternative domains and IP addresses when the connection fails.
The Fast Flux tab of the x47.c operator panel shows six domains, eight IP addresses, as well as the preferred hostname and IP for individual bots. This gives the operator a view of the configured destinations and the connections bots are using.
Several of those domains can point to a single VPS, according to the documentation. Switching hostnames may therefore return a bot to the same server. The configuration provides alternative connection destinations, but the domain count alone does not show how many independent C2 servers are available.
Alongside C2 reconnection, x47.c includes an “AI Stealth” module designed to maintain persistence on infected machines. It is described as using xAI Grok to assess the host’s state and choose from predefined actions for persistence and concealment.
The operator enables those calls by including an xAI key in the build. The supplied status messages report startup changes, persistence repair, and Windows Defender exclusions. They also show local fallback actions when a model call fails, allowing host maintenance to continue without a successful AI response.
The documented persistence options include startup entries and scheduled tasks. Process hollowing and privilege elevation are optional, with the bot described as continuing to run if either fails. The AI component supports these host-maintenance functions, while the operator remains responsible for choosing DDoS targets.
Operators can also download, update, and remove software through the host-management commands. A competing-malware removal module is intended to clear rival artifacts from infected machines. WraithTools additionally advertises a rootkit, although the documentation does not specify a kernel-level implementation.
With those mechanisms intended to preserve access, x47.c gives operators two further ways of using an infected machine: collecting credentials and relaying traffic. Both are controlled from the same desktop panel.
The stealer documentation lists browser passwords, cookies, and Discord tokens as collection targets. The Stealer Logs tab of the x47.c operator panel groups the reported results by host and shows counts for passwords, cookies, and tokens, allowing an operator to review the material returned from individual machines.
The advertisement also lists wallets and AI-site tokens among the collection targets. Although AI draining appears in the same package, the documentation does not describe stolen tokens being converted into provider API keys or passed automatically to the drain command. That command requires the operator to supply a valid account key.
Beyond collecting data, the SOCKS5 module turns the infected machine into a traffic relay. It uses a documented reverse connection through C2 to support hosts behind network address translation, with relayed traffic leaving through the victim’s network. In the x47.c operator panel, the SOCKS5 tab lists proxy connections, health-check results, and timeouts so the operator can track which relays are available.
Defending against x47.c involves three separate problems: preventing endpoint infection, protecting exposed AI accounts, and defending services against DDoS attacks launched by infected machines.
On the endpoint side, conventional security solutions such as AV/EDR should detect and block the malware before it establishes persistence. If a host is already infected, security teams should isolate it, remove the bot and its persistence mechanisms, and investigate potentially stolen credentials and sessions. Removing the malware does not invalidate data that has already been stolen, so compromised credentials and tokens must be revoked.
AI provider accounts require separate attention wherever an API key may have been exposed. Revoke compromised keys and compare usage and billing records with legitimate application activity. Spending limits and controls over automatic top-ups can limit financial damage. Crucially, the documented AI API drain module of x47.c sends requests directly to the AI provider, so filtering traffic at the victim’s website will not stop these calls.
Finally, network services need protection against DDoS attacks launched by x47.c bots. The documented methods include HTTP floods, connection exhaustion, TCP and UDP floods, as well as reflection and amplification techniques, so protection needs to cover both application and network layers.
The following identifiers were taken from the screenshots and technical documentation reviewed for this article. They can support an investigation, but filenames and protocol strings should be corroborated with host and network activity.
The behaviors described above map to the following MITRE ATT&CK techniques. These mappings reflect the supplied documentation and screenshots.
Share your experience and expectations regarding DDoS protection. Your answers will help us tailor solutions to meet your cybersecurity needs.
Tell us about your company’s infrastructure and critical systems. This will help us understand the scope of protection you require.
Help us learn about how decisions are made in your company. This information will guide us in offering the most relevant solutions.
Let us know what drives your choices when it comes to DDoS protection. Your input will help us focus on what matters most to you.
