Palo Alto Networks' Unit 42 has uncovered a new version of the Kimwolf Android and IoT botnet that adds stealth to its DDoS attacks and multiple backup mechanisms designed to keep infected devices connected when command-and-control (C2) servers are disrupted.
The variant, dubbed Kimwolf v7, was discovered on February 3, 2026, during threat-hunting efforts that followed earlier research.
Kimwolf, also associated with the Aisuru botnet ecosystem, has operated since 2024 and shifted heavily toward Android TV boxes and set-top boxes during 2025. Previous research estimated that Kimwolf had compromised more than 1.8 million devices worldwide.
More convincing DDoS traffic
One of Kimwolf v7's most significant additions is an HTTP/2 flooding capability designed to imitate legitimate web browsers.
Unit 42 found that the malware constructs detailed browser fingerprints when generating requests, making malicious traffic more closely resemble ordinary Chrome browsing. This can make application-layer DDoS attacks harder for automated defenses to distinguish from legitimate visitors.
The malware supports 15 DDoS methods, including TCP, UDP, DNS, ICMP, TLS/HTTPS, and HTTP/2 floods. One high-performance UDP mode is optimized for ARM processors commonly found in Android TV boxes, enabling infected devices to generate packets more efficiently.
Unit 42
At the same time, the developers appear to have removed scanning, brute-force, and exploitation features previously associated with the malware. Unit 42 believes this indicates a division of labor in which external tools handle the initial compromise, while Kimwolf focuses on DDoS attacks and traffic proxying.
Kimwolf has commonly spread by abusing residential proxy networks to reach Android Debug Bridge (ADB) services inside home networks. Some Android TV devices expose ADB on port 5555 without authentication, allowing attackers who gain network access to install malware remotely.
Built to survive server takedowns
Kimwolf v7 also introduces a layered C2 system apparently designed in response to disruptions of its infrastructure in December 2025.
The malware can query Ethereum Name Service (ENS) records through five legitimate public Ethereum RPC providers to obtain current C2 addresses. If that method fails, it includes a hard-coded Tor .onion service as an additional route to its operators.
Unit 42 also identified a separate Ethereum RPC endpoint, eth[.]rpcuniverse[.]com, which researchers assess with moderate confidence to have been controlled by the Kimwolf operators. Analysis of related infrastructure revealed 22 servers on the same Russian hosting network sharing an identical SSH host key.
The findings provide additional detail on a botnet that has already faced significant disruption. In March, US and international authorities dismantled infrastructure associated with Kimwolf and several other IoT botnets. In May, Canadian authorities arrested 23-year-old Jacob Butler, who US prosecutors allege operated Kimwolf as a DDoS-for-hire service. The charges remain allegations unless proven in court.
Unit 42 recommends treating inexpensive Android TV boxes as potentially untrusted devices and isolating them from sensitive networks. ADB should be disabled when unnecessary or restricted to USB access, while unexpected Ethereum RPC connections, Tor traffic, or a process named netd_service on Android TV devices can be signs warranting investigation.
Leave a Reply