Loading story…
Researchers reported that the Kimwolf botnet has evolved from a massive Android malware operation previously tied to roughly 1.8 million infected devices into a new v7 variant focused on Android TV boxes and set-top boxes. The newer strain was discovered targeting exposed devices through unauthenticated Android Debug Bridge (ADB) access on local networks, with propagation aided by abuse of residential proxy services. Investigators said the malware now appears to separate initial compromise from later bot activity, with external loaders handling installation while the bot binary concentrates on distributed denial-of-service and proxy relay functions.
Analysis of Kimwolf v7 found upgraded attack and resilience features, including an HTTP/2 flood capability designed to mimic realistic browser fingerprints and a more durable command-and-control scheme using Ethereum Name Service (ENS) resolution, a Tor .onion fallback, and a local proxy architecture. Researchers also linked the botnet to clustered C2 infrastructure in AS202799 in Saint Petersburg, Russia, and identified eth.rpcuniverse[.]com as a likely operator-controlled RPC facade, indicating continued investment in infrastructure intended to keep the botnet operational and harder to disrupt.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
An international law-enforcement operation in March 2026 disrupted previous versions of the Kimwolf botnet and ended with seizure of its infrastructure. Unit 42 said the newer version had appeared about a month earlier, reducing the impact of conventional takedown measures.
Unit 42 discovered the Kimwolf v7 Android/IoT botnet variant on February 3, 2026. The version primarily targets Android TV boxes and set-top boxes and adds updated DDoS and C2 capabilities.
Unit 42 identified 212.193.31[.]102 as the first observed host in a Kimwolf-related SSH-key cluster of infrastructure in AS202799, geolocated to Saint Petersburg, Russia.
Unit 42 said Kimwolf's infrastructure suffered two domain takedowns in December 2025, prompting the botnet's later three-tier command-and-control resolution design for resilience.
Unit 42 identified eight Android APK artifacts linked to Kimwolf between October and December 2025. The APKs masqueraded as a system service, probed for root access, and executed a bundled ELF payload to help propagate the botnet on Android devices.
Around August 2025, the operators transitioned from the Linux-focused AISURU codebase to the Android-targeting Kimwolf codebase, focusing on Android TV boxes and set-top boxes.
Unit 42 reported that the botnet operators were active starting in August 2024, initially tracking the operation as AISURU when it targeted Linux IoT devices.
8 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecommunity.gurucul.com
Open sourcesecurityaffairs.com
Open sourcecyberscoop.com
Open sourcethehackernews.com
Open sourceunit42.paloaltonetworks.com
Open sourceblog.xlab.qianxin.com
Open sourceradar.cloudflare.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers identified **Kimwolf v7**, an updated variant of the Kimwolf/AISURU Android and Linux IoT botnet, adding an **HTTP/2 flood** capability designed to make distributed denial-of-service traffic resemble normal web browsing. The malware reportedly generates realistic **Chrome-like browser fingerprints**, complicating detection, while continuing to target **Android TV devices** through exposed **ADB on port `5555`** and Linux IoT systems through the AISURU branch. Analysts said the botnet has been active since at least mid-2024 and has continued evolving its Android infection chain with APKs disguised as system services that check for root access and execute an embedded ELF payload.
Aug 13, 2026
The Kimwolf botnet has rapidly infected over 1.8 million Android-based devices worldwide, with security researchers warning that the true number may exceed 2 million. The malware primarily targets Android TV boxes, digital photo frames, and other IoT devices, many of which are distributed through major online retailers and often ship with weak security controls or pre-installed malicious software. Kimwolf leverages advanced techniques such as DNS-over-TLS, blockchain-based command and control via Ethereum Name Service (ENS), and residential proxy networks to evade detection and takedown efforts. The botnet enables attackers to launch high-volume DDoS attacks, monetize proxy bandwidth, and conduct lateral movement within local networks, posing a significant threat to both enterprise and consumer environments. Security experts have identified that two-thirds of Kimwolf infections are Android TV boxes lacking basic authentication, making them especially vulnerable. The operators behind Kimwolf, previously linked to the Aisuru botnet, are known for their technical sophistication and rapid adaptation to takedown attempts. Their monetization strategies include ad fraud, DDoS-for-hire services, and the resale of residential proxy bandwidth. The malware often spreads through bundled mobile apps and games, exploiting the global supply chain of low-cost Android devices. Organizations and individuals are urged to identify, isolate, and remediate infected devices to prevent further exploitation and participation in criminal infrastructure.
Jun 29, 2026
The Kimwolf botnet has infected approximately 1.8 million Android-based devices worldwide, including smart TVs, set-top boxes, and tablets, making it one of the largest Android botnets identified to date. Security researchers from Xlab Qianxin and other organizations discovered that Kimwolf leverages advanced evasion techniques such as DNS over TLS and elliptic-curve digital signatures to bypass detection and secure command verification. The malware is distributed globally, with the highest infection rates in Brazil, India, and the United States, and is capable of launching destructive cyberattacks at scale due to its robust network infrastructure. Kimwolf is compiled using the Android NDK and provides attackers with a range of capabilities, including DDoS attacks, proxy forwarding, reverse shell access, and file management. The botnet has issued over 1.7 billion DDoS commands in a three-day period and has demonstrated resilience by shifting to Ethereum Name Service (ENS) for its command-and-control infrastructure after repeated domain takedowns. The infection mechanism involves an APK that extracts a native binary payload, ensuring persistence and single-instance execution on each device. The exact propagation method remains unclear, but the botnet's rapid evolution and global reach pose a significant threat to Android device security.
Jun 29, 2026