Loading story…
Researchers identified Kimwolf v7, an updated variant of the Kimwolf/AISURU Android and Linux IoT botnet, adding an HTTP/2 flood capability designed to make distributed denial-of-service traffic resemble normal web browsing. The malware reportedly generates realistic Chrome-like browser fingerprints, complicating detection, while continuing to target Android TV devices through exposed ADB on port 5555 and Linux IoT systems through the AISURU branch. Analysts said the botnet has been active since at least mid-2024 and has continued evolving its Android infection chain with APKs disguised as system services that check for root access and execute an embedded ELF payload.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Unit 42 at Palo Alto Networks discovered Kimwolf v7 in February 2026. The new version added HTTP/2 DDoS capability, browser fingerprint imitation, and hardened command-and-control mechanisms using ENS and Tor.
Unit 42 observed the operators revert the malware library naming change in December 2025 after the November switch to libdevice.so. Both names also appear in the indicator-only reference.
Unit 42 observed the operators change a malware component name from libn[redacted]kernel.so to libdevice.so in November 2025. This was described as an operational security naming change.
Unit 42 identified eight Android APK samples between October and December 2025 that masqueraded as a system service and checked for root before executing an embedded ELF payload. The earliest identified sample targeted x86 architecture using the Dirty COW exploit.
Kimwolf has targeted Android TV devices since at least August 2025 by abusing exposed Android Debug Bridge on port 5555. Unit 42 assessed this reflected a shift toward an Android propagation model.
The Kimwolf/AISURU botnet was active by at least mid-2024, according to Unit 42. The malware family targeted Android and Linux IoT environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcemkd-cirt.mk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **Kimwolf** botnet has evolved from a massive Android malware operation previously tied to roughly **1.8 million infected devices** into a new **v7** variant focused on **Android TV boxes and set-top boxes**. The newer strain was discovered targeting exposed devices through unauthenticated **Android Debug Bridge (ADB)** access on local networks, with propagation aided by abuse of residential proxy services. Investigators said the malware now appears to separate initial compromise from later bot activity, with external loaders handling installation while the bot binary concentrates on distributed denial-of-service and proxy relay functions. Analysis of Kimwolf v7 found upgraded attack and resilience features, including an **HTTP/2 flood** capability designed to mimic realistic browser fingerprints and a more durable command-and-control scheme using **Ethereum Name Service (ENS)** resolution, a **Tor `.onion` fallback**, and a local proxy architecture. Researchers also linked the botnet to clustered C2 infrastructure in **AS202799** in Saint Petersburg, Russia, and identified **`eth.rpcuniverse[.]com`** as a likely operator-controlled RPC facade, indicating continued investment in infrastructure intended to keep the botnet operational and harder to disrupt.
Aug 13, 2026
The Kimwolf botnet has infected approximately 1.8 million Android-based devices worldwide, including smart TVs, set-top boxes, and tablets, making it one of the largest Android botnets identified to date. Security researchers from Xlab Qianxin and other organizations discovered that Kimwolf leverages advanced evasion techniques such as DNS over TLS and elliptic-curve digital signatures to bypass detection and secure command verification. The malware is distributed globally, with the highest infection rates in Brazil, India, and the United States, and is capable of launching destructive cyberattacks at scale due to its robust network infrastructure. Kimwolf is compiled using the Android NDK and provides attackers with a range of capabilities, including DDoS attacks, proxy forwarding, reverse shell access, and file management. The botnet has issued over 1.7 billion DDoS commands in a three-day period and has demonstrated resilience by shifting to Ethereum Name Service (ENS) for its command-and-control infrastructure after repeated domain takedowns. The infection mechanism involves an APK that extracts a native binary payload, ensuring persistence and single-instance execution on each device. The exact propagation method remains unclear, but the botnet's rapid evolution and global reach pose a significant threat to Android device security.
Jun 29, 2026
Security researchers reported explosive growth of the **Kimwolf** botnet to **2+ million infected devices** globally, with heavy concentrations including Vietnam, Brazil, India, Saudi Arabia, Russia, and the United States. Synthient assessed that roughly **two-thirds of infections are insecure Android TV boxes**, and described Kimwolf’s primary impact as large-scale abuse traffic (ad fraud, account takeover attempts, scraping) and **high-capacity DDoS** capable of disrupting major websites for extended periods. A key concern is Kimwolf’s propagation method: leveraging **residential proxy networks** to effectively tunnel “back” into home/SMB networks via proxy endpoints and then infect additional devices that users assume are protected behind NAT/firewalls and consumer routers. KrebsOnSecurity further tied operational activity to the botnet controller, a threat actor using the handle **“Dort,”** who allegedly retaliated against a vulnerability discloser and the journalist with **DDoS, doxing, email flooding**, and an apparent **SWATing** incident. Open-source and commercial intelligence cited in the reporting linked “Dort” to historical aliases (e.g., **CPacket**, **M1ce**) and to accounts on cybercrime forums, and noted prior involvement in enabling abuse tooling (e.g., CAPTCHA-bypass code and temporary email services) and presence in communities associated with cybercrime groups (including references to **LAPSUS$** chat activity).
Jun 29, 2026