Kimwolf
KimWolf is a large Android- and IoT-focused DDoS botnet and DDoS-for-hire platform, widely described as a variant or Android variant of Aisuru/AISURU and in some reporting as Mirai-derived. It emerged in late 2025 and primarily targets Android TV boxes, streaming devices, set-top boxes, webcams, digital photo frames, and other internet-connected devices, especially systems with exposed Android Debug Bridge (ADB) services and devices reachable through abused residential proxy networks. Multiple sources in the content state that KimWolf infected more than 1 million devices worldwide, with several researchers estimating roughly 1.8 to over 2 million compromised Android devices and about 12 million unique IP addresses observed weekly.
Its documented capabilities include volumetric DDoS attack execution, proxy forwarding/SOCKS proxy functionality, reverse shell access, and file management. Reporting in the content also states that samples were compiled with the Android NDK, used DNS over TLS to conceal communications, authenticated C2 instructions with elliptic-curve digital signatures, encrypted sensitive data with a simple stack XOR method, and in newer versions incorporated EtherHiding via blockchain domains for resilience. KimWolf has been linked to residential proxy abuse and internal-network probing; Infoblox specifically noted it as an example of poorly designed proxy-enabled malware that could probe internal networks. The botnet was also linked by Synthient to the IPIDEA proxy network, and other reporting tied its monetization or infrastructure to residential proxy ecosystems.
Operationally, KimWolf was run as a cybercrime-as-a-service or subscription DDoS-for-hire platform that rented access to compromised devices to other criminals. Authorities stated it was used in more than 25,000 attacks worldwide, including attacks against Department of Defense Information Network (DoDIN) IP space, with some attacks reported at nearly 30 Tbps and up to 31.4 Tbps. Some victim organizations reportedly suffered losses exceeding $1 million. The botnet has been associated with rapid rebuilding of its control plane after disruption pressure and with broad global spread across 200+ countries in some reporting.
The malware has been associated with Jacob Butler, aka "Dort," who was arrested by Canadian authorities at the request of the United States in 2026 for allegedly developing or operating KimWolf. Law-enforcement actions in March 2026 disrupted infrastructure associated with KimWolf alongside Aisuru, JackSkid, and Mossad, and additional seizures targeted DDoS-for-hire services linked to the broader ecosystem.
High-confidence infrastructure and indicators mentioned in the content include the ENS domain pawsatyou[.]eth, the previously used domain 14emeliaterracewestroxburyma02132[.]su, downloader IPs 93[.]95[.]112[.]50-59 associated with Resi Rack LLC, and references to the account resi[.]to. The malware has also been observed on off-brand Android TV hardware marketed under names such as TV BOX, SuperBox, XBOX, and SmartTV.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Another variant, KimWolf, targets Android systems, including mobile phones and Smart TVs.
"The cybercriminals in control of Kimwolf — a disruptive botnet that has infected more than 2 million devices — recently shared a screenshot indicating they’d compromised the control panel for Badbox 2.0"
"The cybercriminals in control of Kimwolf — a disruptive botnet that has infected more than 2 million devices — recently shared a screenshot indicating they’d compromised the control panel for Badbox 2.0"
Techniques & procedures
22 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniques
Resource Development
Initial Access
3 techniques
Initial Access
Prime targets included Android TVs and streaming devices with exposed Android Debug Bridge (ADB) services.
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Discovery
2 techniques
Discovery
Lateral Movement
2 techniques
Lateral Movement
Command and Control
9 techniques
Command and Control
It encrypts sensitive data with a simple Stack XOR... Recent versions even incorporate EtherHiding to resist takedowns via blockchain domains.
In March 2026, authorities in the United States, Germany, and Canada seized command-and-control systems linked to KimWolf and three related botnets identified as Aisuru, JackSkid, and Mossad.
It encrypts sensitive data with a simple Stack XOR, uses DNS over TLS to hide communication, and authenticates C2 commands with elliptic curve digital signatures.
В первом квартале аналитики Synthient нашли связь нашумевшего ботнета Kimwolf с прокси-сетью IPIDEA. Затем эта сеть была ликвидирована при участии GTIG.
A proxy inside a private network allows both inbound internet traffic and access to internal systems.
Kimwolf botnet has compromised more than 2 million Android devices, spreading primarily via residential proxy networks... Its primary function is traffic proxying, though it can execute massive DDoS attacks.
Kimwolf/Aisuru Tactic Technique ID Application C2 Web Service T1102.002 Ethereum ENS (pawsatyou[.]eth)
IOCs tracked for this family
25 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
133 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Kimwolf is described as a botnet tied to residential proxy activity and internal network probing. The report highlights its presence in enterprise environments and notes that it could route or facilitate attacks against internal IP space through compromised or enrolled devices.
DDoS-ботнет и cybercrime-as-a-service платформа, заразившая почти 2 млн Android- и IoT-устройств. Использовалась для проведения более 25 000 DDoS-атак по всему миру, с пиковой мощностью отдельных атак до 31,4 Тбит/с.
An IoT DDoS-for-hire botnet allegedly used to compromise consumer and small-office devices such as digital photo frames and webcams, enroll them into a distributed attack infrastructure, and launch high-volume distributed denial-of-service attacks worldwide.
A newly discovered Android/IoT botnet used as a DDoS-for-hire service. It primarily targets Android TV boxes and supports DDoS attacks, traffic proxying, reverse shell access, and file management. The malware uses Stack XOR to encrypt sensitive data, DNS over TLS to conceal communications, elliptic curve digital signatures to authenticate C2 commands, and newer versions incorporate EtherHiding via blockchain domains to resist takedowns.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.