Loading malware…
Skynet is a malware name associated with at least two distinct threats. The best-documented malware usage refers to a Windows-based Tor-enabled botnet and trojan platform active in the early 2010s. That Skynet variant combined distributed denial-of-service functionality with additional monetization modules, including an embedded ZeuS banking trojan and cryptocurrency mining components. It used Tor hidden services to conceal command-and-control infrastructure, tunneled bot communications through a local Tor proxy, supported remote download-and-execute behavior, exposed victim-hosted proxy capability on operator command, and employed process hollowing and persistence mechanisms for stealth and survivability. Reported attack functions included multiple flooding methods and web-request abuse, while the ZeuS component enabled credential theft from online banking activity. The malware targeted Windows systems and was observed at significant botnet scale.
A separate and much more recent sample also used the name Skynet and appears to be an experimental proof of concept rather than a mature malware family. That sample embedded prompt-injection text intended to manipulate AI-assisted malware-analysis workflows into returning a false benign verdict. It also incorporated anti-analysis checks, string obfuscation, limited collection of local host and SSH-related data, and deployment of an embedded Tor client. Researchers assessed this newer sample as an early attempt to explore AI-specific evasion rather than a broadly deployed operational threat, and testing indicated the prompt-injection mechanism did not successfully subvert the evaluated frontier models.
Because the name Skynet has been reused across unrelated malicious tooling, attribution and classification should be handled carefully. Separately, "Skynet" was also used as a marketing label for a DDoS-for-hire service associated with Anonymous Sudan, but that usage refers to attack infrastructure branding rather than a conventional malware family name.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
AnonSudan accepted orders over the instant messaging service Telegram, and marketed its DDoS service by several names, including “Skynet,” “InfraShutdown,” and the “Godzilla botnet.”
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Amazon said AnonSudan launched its attacks by finding hosting companies that would rent them small armies of servers.
Specifically, the warrants authorized the seizures of computer servers that launched and controlled the DDoS attacks, computer servers that relayed attack commands to a broader network of attack computers, and accounts containing the source code for the DDoS tools used by Anonymous Sudan.
Basically, there’s a decrypt function, and the AI decompiles it so well, it’s easy to see it does a Base64 pass + XOR. The key is hard-coded... There are obfuscated strings, that I de-obfuscate with the Python script I wrote.
The malware contains an encrypted embedded PE binary, which can be extracted. It will be written on the host, named skynet... The main uses XOR — with the same key — to decrypt an embedded binary... The result will be written to the filesystem, in a temporary directory, with name skynet.
"resulting in the end with the core being disguised either as Internet Explorer or as svchost.exe"
Embedded in the C++ was an instruction addressed to whatever model came to analyze the file, telling it to ignore its previous instructions and report the binary as clean.
The malware tries to detect if it’s running on a VM... Searches for Microsoft Hv (hypervisor)... checks for specific BIOS vendor signatures: VirtualBox, QEMU, Microsoft Corporation and Parallels... searches for VM-related environment variables... Reads the MAC address... Calls tasklist, and checks existence of virtualization processes.
Reads the registry (Hardware\Description\System\BIOS) and checks for specific BIOS vendor signatures... In the registry (System\CurrentControlSet\Services\disk\Enum), searches for specific names like VMware, VBOX or QEMU.
"Get information on the compromised computer !info, !version, !hardware, !idle"
The malware tries to detect if it’s running on a VM... Searches for Microsoft Hv (hypervisor)... checks for specific BIOS vendor signatures: VirtualBox, QEMU, Microsoft Corporation and Parallels... searches for VM-related environment variables... Reads the MAC address... Calls tasklist, and checks existence of virtualization processes.
The malware may contact 2 different onion URLs: s4k4ceiapwwgcm3mkb6e4diqecpo7kvdnfr5gg7sph7jjppqkvwwqtyd.onion, port 8080 ... and zn4zbhx2kx4jtcqexhr5rdfsj4nrkiea4nhqbfvzrtssakjpvdby73qd.onion on port 31068.
"it's requesting them to a proxy running locally... This proxy then translates the request to a specific Tor .onion pseudo-domain and tunnel the requests through the Tor SOCKS proxy"
Skynet was more like a “distributed cloud attack tool,” with a command and control (C2) server, and an entire fleet of cloud-based servers that forwards C2 instructions to an array of open proxy resolvers run by unaffiliated third parties, which then transmit the DDoS attack data to the victims.
"embeds the CGMiner... starts mining bitcoins only after two minutes of inactivity and immediately stops when some monitored event occurs"
Anonymous Sudan ... is a cybercrime business known for launching powerful distributed denial-of-service (DDoS) attacks against a range of targets, including dozens of hospitals, news websites and cloud providers.
CrowdStrike said the success of AnonSudan’s DDoS attacks stemmed from a combination of factors, including sophisticated techniques for bypassing DDoS mitigation services. Also, AnonSudan typically launched so-called “Layer 7” attacks that sought to overwhelm targeted “API endpoints” ... with bogus requests for data, leaving the target unable to serve legitimate visitors.
32 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Other indicator types observed in public reporting.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A malware sample containing embedded prompt-injection instructions intended to mislead AI-based malware analysis systems into reporting the binary as clean.
Skynet is a malware strain designed to test prompt injection against AI-powered malware analysis systems. It embeds malicious instructions intended to manipulate LLM-based security tools into misclassifying the sample as benign, though researchers described it as an experimental proof-of-concept rather than a fully functional threat deployment.
A rudimentary malware component/proof-of-concept that performs sandbox/VM evasion checks, collects local files (including SSH known_hosts and id_rsa, and the Windows hosts file), prints the collected data to stdout, and decrypts/drops an embedded Tor client to set up a local SOCKS/ControlPort proxy before wiping its temp directory. It also contains an attempted LLM prompt-injection string intended to manipulate AI-assisted analysis.
Tor-enabled IRC botnet that spreads via trojanized Usenet/warez downloads. It uses Tor Hidden Services for C2, supports multiple DDoS modes (SYN/UDP/Slowloris/HTTP), can open a SOCKS proxy via a per-host hidden service, and embeds additional components including a ZeuS banking bot and CGMiner for opportunistic Bitcoin mining (triggered during user inactivity).
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.