New Dolphin X Malware Uses AI to Profile and Rank High-Value Targets

Emerging remote access trojans are increasingly automating victim assessment, as demonstrated by the newly discovered Dolphin X malware. This new RAT incorporates an AI-powered profiling feature designed to evaluate host data, rank infected users, and flag high-value corporate targets for immediate follow-on exploitation.

Automated Triage via AI Profiling

Traditional malware operators often struggle with triage when large-scale distribution campaigns yield thousands of compromised endpoints. Operators typically have to manually inspect system information, active directory connections, and local browser data to identify high-value targets such as network administrators, finance personnel, or executive workstations.

The Dolphin X malware attempts to solve this bottleneck by running an automated profiling module on newly infected systems. By feeding host context—such as domain join status, installed management software, network adapter profiles, and user telemetry—into an AI scoring engine, the malware assigns each victim a value score. Operators receive real-time notifications prioritizing victims that offer the highest potential return on investment for hands-on-keyboard operations or ransomware deployment.

Capabilities of the Dolphin X RAT

Beyond its AI profiling mechanism, Dolphin X functions as a standard remote access trojan capable of laying the groundwork for broader network intrusion. Its primary capabilities include:

• System information gathering and environment enumeration.
• Execution of arbitrary commands via Windows command shell or PowerShell.
• Persistence mechanisms utilizing registry run keys and scheduled tasks.
• Exfiltration of saved credentials and browser session data.

Because the malware prioritizes high-scoring endpoints, infected systems operating inside enterprise active directory domains are likely to face rapid secondary payload delivery or credential dumping attempts.

Defense and Mitigation

Detecting Dolphin X requires focusing on early-stage RAT indicators and anomalous outbound traffic patterns. Security operations teams should implement the following targeted measures:

• Monitor endpoint detection and response (EDR) telemetry for unauthorized persistence creation under HKCU\Software\Microsoft\Windows\CurrentVersion\Run and unscheduled task creation.
• Block outbound communication to unrated or freshly registered domains associated with command-and-control (C2) infrastructure used by emerging RAT families.
• Restrict local administrator permissions to prevent malware operators from elevating privileges on initial access endpoints.