Key Takeaways
- Researchers from Palo Alto Networks Unit 42 identified a new iteration of the Kimwolf/AISURU botnet, dubbed Kimwolf v7, in February 2026.
- The version adds an HTTP/2‑based DDoS flood that builds full browser fingerprints, making malicious traffic blend with normal browsing.
- Command‑and‑control (C2) resilience is boosted via a tiered mechanism using Ethereum Name Service (ENS), a hard‑coded Tor .onion address, and a local proxy, while scanning/exploit modules were stripped out.
- Propagation now relies on an external loader that gains initial access (e.g., via ADB on Android TV boxes); the Kimwolf binary focuses solely on DDoS and relay functions.
- The botnet targets Android TV boxes (ADB port 5555) and Linux IoT devices, disguising itself as legitimate system processes such as “netd_service”.
- Mitigation advice includes segmenting Android TVs from enterprise networks, disabling or USB‑restricting ADB, and monitoring for anomalous HTTP/2 traffic.
Overview of Kimwolf v7
Kimwolf v7 represents the latest evolution of the Kimwolf/AISURU botnet family, first observed targeting Android TV boxes in August 2025 and active since at least mid‑2024. Discovered by Palo Alto Networks Unit 42 researchers Asher Davila, Chris Navarrete, and Doel Santos in February 2026, this version introduces several technical refinements aimed at increasing operational resilience and evading detection. While retaining the core functionality of conducting distributed denial‑of‑service (DDoS) attacks and acting as a traffic relay, Kimwolf v7 drops the earlier scanning, exploitation, and brute‑force modules, signalling a deliberate shift in the threat actors’ operational model.
Technical Improvements and DDoS Capabilities
A standout addition in Kimwolf v7 is an HTTP/2‑based flood attack powered by the nghttp2 library. Unlike simpler volumetric floods, this feature crafts complete browser fingerprints at the protocol and header level, mimicking legitimate browser behavior and thereby complicating traffic‑analysis defenses. Complementing the HTTP/2 flood, the botnet retains a high‑performance UDP flood function specifically tuned for ARM processors prevalent in Android TV boxes. All DDoS commands have been consolidated into 15 numbered methods, down from the 43 text‑named methods used in prior releases, streamlining the attacker’s control interface while maintaining a broad attack repertoire.
Command-and-Control Resilience Mechanisms
To harden its C2 infrastructure against takedowns, Kimwolf v7 employs a tiered resolution strategy. First, it queries legitimate public Ethereum RPC services to resolve an ENS domain, obtaining the primary C2 address. If that fails, a hard‑coded Tor .onion hidden service (edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion) serves as a backup. Regardless of whether the final destination lies on the clearnet or Tor network, all C2 traffic is routed through a local proxy listening on 127.0.0.1:23075, creating a consistent internal chokepoint that obscures the true external endpoints. This layered approach removes the need for embedded scanning or exploit code, reducing the binary’s footprint and attack surface.
Propagation Shift and External Loader
The removal of scanning and exploitation modules indicates that the Kimwolf operators have decoupled initial access from the payload. An external loader—likely distributed via compromised app stores, phishing, or supply‑chain chains—gains a foothold on target devices (e.g., by exploiting ADB exposure on Android TV boxes) and then delivers the Kimwolf binary. Once installed, the binary’s sole responsibilities are executing DDoS attacks and acting as a proxy relay for malicious traffic. This modular design enables the threat actors to update or replace the loader independently, improving flexibility and reducing the risk of detection through static signatures on the core payload.
Target Devices and Infection Vector
Kimwolf has historically focused on Android TV boxes that ship with Android Debug Bridge (ADB) enabled on port 5555 within local networks. The malware abuses residential proxy services to reach these devices, installs itself, and then uses the infected box as a launchpad for DDoS attacks or as a hop in a larger proxy chain. Its Linux counterpart, AISURU, continues to target a broader range of IoT devices running Linux distributions. The ADB‑based propagation model marks a clear evolution from earlier Linux‑centric exploitation tactics (such as Dirty COW) toward leveraging misconfigured consumer electronics that are often inadequately secured in home environments.
Stealth Techniques and Process Masquerading
After execution, Kimwolf v7 attempts to blend in with legitimate Android system processes by masquerading as services like “netd_service”. This process‑name spoofing helps the malware evade casual inspection and basic endpoint‑detection tools that rely on known malicious binaries. Additionally, the use of legitimate Ethereum RPC queries and Tor‑based C2 channels further obscures malicious network traffic, making it resemble routine blockchain interactions or privacy‑focused browsing. These stealth measures collectively increase the botnet’s longevity on compromised hosts before defenders notice anomalous behavior.
Related Botnet Trends and Mitigation Recommendations
The Unit 42 report places Kimwolf v7 alongside several emerging threats observed in recent months: AryStinger (router‑based reconnaissance/proxy network), RustDuck (router, camera, Android box, and server hijacking for DDoS), NadMesh (autonomous scanner targeting Redis, Docker, MCP, Kubernetes, and AI‑service platforms to harvest credentials and deploy SSH backdoors), and Tengu (a Mirai‑derived IoT telnet‑brute‑force botnet). The common thread is the exploitation of poorly managed consumer‑grade devices to build large‑scale, resilient attack infrastructures. Defenders are advised to treat Android TV boxes as untrusted assets, segment them from corporate networks, disable ADB or restrict it to USB‑only connections, monitor for unusual HTTP/2 traffic patterns, and enforce strict firewall rules limiting inbound connections to non‑standard ports such as 5555. Regular firmware updates and disabling unnecessary debugging interfaces further reduce the attack surface.
Conclusion
Kimwolf v7 illustrates how botnet operators continuously refine their tools to improve evasion, resilience, and efficiency. By shedding noisy scanning components, adopting sophisticated fingerprint‑matched HTTP/2 floods, and layering C2 resolution through ENS, Tor, and local proxies, the threat actors have created a more stealthy and durable platform. Organizations must recognize that everyday consumer devices—particularly Android TV boxes with exposed ADB—can become potent weapons in large‑scale DDoS campaigns when left unsecured. Proactive network segmentation, strict device hardening, and vigilant traffic analysis remain essential defenses against this evolving threat landscape.