Overview
A newly advertised remote access trojan dubbed Dolphin X has drawn attention from threat researchers for incorporating an AI-powered victim profiling system into its operator panel. Analysed by Varonis Threat Labs researcher Daniel Kelley, the malware was spotted being marketed on cybercrime forums by a vendor using the alias Kontraktnik. The tool presents itself as an all-in-one RAT with 329 advertised features across ten categories, but its most operationally significant capability is the AI Profiler — a scoring engine that automatically ranks infected machines by their potential value to attackers.
Technical Analysis
The Dolphin X operator panel includes a dedicated surveillance tab housing the AI Profiler module. According to Varonis, the feature ingests data collected from compromised hosts — including application usage patterns, installed software inventories, browser domain histories, and behavioural signals — and synthesises this into a per-victim risk score and categorical tags.
Attackers receive daily summary reports listing ranked victim profiles, enabling them to triage large infection pools without manual review. The profiler is described by the vendor as an “AI behavioral profiler with app usage tracking, risk score, and daily summary.” Targets associated with access to corporate networks, cloud environments, cryptocurrency wallets, or production systems are surfaced as high-priority.
Varonis examined the malware builder and network traffic within an isolated lab environment; a live Dolphin X agent was not executed on an infected host. The credential-stealing component claims coverage of more than 300 applications, compounding the volume problem the AI Profiler is designed to solve.
Framework Mapping
MITRE ATLAS:
- AML.T0047 — ML-Enabled Product or Service: The AI Profiler is embedded directly into criminal infrastructure as a force-multiplier, automating attacker decision-making at scale.
- AML.T0040 — ML Model Inference API Access: The profiler processes victim telemetry through an inference pipeline to produce actionable scores, representing operational ML deployment within malware.
OWASP LLM Top 10:
- LLM08 — Excessive Agency: The AI system autonomously prioritises human targets for further exploitation without manual operator review, delegating consequential decisions to the model.
- LLM06 — Sensitive Information Disclosure: Victim behavioural data, application usage, and access credentials are processed and surfaced to threat actors through the AI summary system.
Impact Assessment
The primary impact of AI-assisted victim triage is operational efficiency for attackers. Credential-stealing campaigns typically generate far more data than operators can manually review; the AI Profiler effectively removes this bottleneck. Organisations with employees in finance, cloud infrastructure, or cryptocurrency will likely be surfaced more frequently by such scoring systems. The feature also lowers the expertise threshold for running large-scale RAT campaigns, potentially broadening the threat actor pool.
Mitigation & Recommendations
- Enforce multi-factor authentication on all accounts, particularly those tied to corporate access, cloud platforms, and financial services, to reduce the exploitability of stolen credentials.
- Deploy behavioural endpoint detection capable of identifying RAT communication patterns and unusual telemetry exfiltration consistent with profiling activity.
- Audit installed software and browser profiles on endpoints to understand what data a profiler could extract and rank.
- Monitor dark web and cybercrime forums for Dolphin X infrastructure indicators released by Varonis and similar threat labs.
- Segment high-value systems so that compromised endpoints cannot directly reach production or cloud management environments.
References
- New Dolphin X malware uses AI to rank high-value targets — BleepingComputer
- Varonis Threat Labs analysis by Daniel Kelley (referenced in source article)