Malware uses LLMs to rank victims by how much they're worth

Malware has been observed using Large Language Models (LLMs) to prioritize victims based on their perceived value. The malware's hardcoded model selection, with a low temperature value of 0.2, indicates a focus on accuracy and consistency. It also features a failover mechanism, cascading to models like kimi-k2 and gemini-2.5-flash, suggesting the operator anticipates and prepares for potential refusals from the primary LLM, opting for smaller, more permissive alternatives.

Unlike earlier malware that indiscriminately attacked targets, this variant uses LLMs to rank victims by value, employing a cascading multi-model architecture to ensure consistent operation.