New Dolphin X Malware Variant Deploys AI to Rank High-Value Targets for Cybercriminals

A sophisticated new variant of the Dolphin X remote access trojan has emerged, utilizing artificial intelligence to profile and rank infected users based on their potential value to cybercriminal networks. The updated malware, distributed by a vendor operating under the alias 'Kontraktnik,' introduces an automated scoring system designed to identify which compromised devices warrant immediate exploitation.

The software represents a significant evolution in ransomware-as-a-service operations. Unlike previous iterations that relied on manual analysis or basic heuristics to determine victim worth, this version employs machine learning algorithms to assess the digital footprint of infected systems. The AI component analyzes data collected from targeted computers to generate a priority score for each host. This ranking mechanism allows operators to focus their resources on high-value targets while deprioritizing less lucrative infections.

The vendor behind the operation has marketed the feature as an efficiency tool, claiming it streamlines the decision-making process for affiliates purchasing access to the malware's capabilities. By automating target selection, the system reduces the time between initial infection and subsequent data exfiltration or ransom demands. The capability is particularly concerning given Dolphin X's history of targeting financial institutions, healthcare providers, and government entities.

Security researchers have noted that the integration of AI into the command-and-control infrastructure marks a shift toward more autonomous cyberattacks. The malware reportedly continues to use established infection vectors, including phishing campaigns and supply chain compromises, but its post-exploitation phase is now driven by algorithmic assessment rather than human intervention alone. This automation allows criminal groups to manage larger botnets with fewer personnel while increasing the precision of their attacks.

The deployment of this feature raises questions about the scalability of AI-driven cybercrime operations. As these tools become more accessible, smaller criminal actors may gain access to targeting capabilities previously reserved for state-sponsored or highly organized groups. The exact criteria used by the algorithm to assign value scores remain undisclosed, though industry analysts suggest factors likely include network size, data sensitivity, and financial standing.

No specific organizations have confirmed infections with this new variant as of Wednesday, July 23, 2026. However, cybersecurity firms are monitoring traffic patterns associated with Kontraktnik's infrastructure for signs of the updated scoring module in action. The emergence of AI-enhanced malware underscores a growing trend where offensive cyber capabilities outpace defensive measures.

Authorities and security vendors continue to investigate how widely this new functionality has been distributed among criminal affiliates. It remains unclear whether the vendor is selling access exclusively through existing channels or if they have expanded their customer base with this advanced offering. As Dolphin X evolves, defenders face an increasingly complex threat landscape where automated systems determine the fate of compromised networks.