Loading malware…
Kimwolf is an Android-focused botnet closely associated with Aisuru, observed by October 2025. It primarily compromises inexpensive, non-certified Android TV and streaming boxes in residential networks, with infections also identified on smart TVs and tablets. Large-scale observations place its infection population in the millions, although dynamic residential addressing complicates precise device counts. Shared distribution scripts, APK signing certificates, payload characteristics, and infrastructure strongly link Kimwolf to the Aisuru operators.
Kimwolf supports distributed denial-of-service attacks, TCP and UDP proxy forwarding, reverse shells, remote command execution, and file management. Proxy-service commands dominated one major telemetry dataset, demonstrating its substantial role in residential bandwidth abuse alongside DDoS operations. Kimwolf has participated in attacks approaching 30 Tbps. Its operators abuse residential proxy infrastructure to reach internal devices, scan for accessible Android Debug Bridge services, and install malicious Android applications and proxy payloads. Observed loader applications use boot receivers to launch embedded native payloads, supporting persistence across device restarts.
Implemented using the Android Native Development Kit, analyzed Kimwolf payloads include packed ARM executables with obfuscated strings and disguised process identities. Its command-and-control mechanisms use encrypted communications, DNS over TLS, encoded server addresses, and elliptic-curve signature verification. Later versions use Ethereum Name Service records through EtherHiding to retrieve command-and-control information and improve resilience against infrastructure disruption. Authorities disrupted Kimwolf infrastructure in March 2026, but subsequent observations documented continued local-network scanning and payload deployment.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
4 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Kimwolf is a botnet compiled using the NDK. In addition to typical DDoS attack capabilities, it integrates proxy forwarding, reverse shell, and file management functions.”
Menace émergente : Kimwolf/Dort # L’acteur individuel Dort a introduit une nouvelle menace en exploitant les proxies résidentiels eux-mêmes comme vecteur pour créer des botnets DDoS , atteignant un pic de ~400 000 IPs exploitées en un seul jour (février-mars 2026).
Another variant, KimWolf, targets Android systems, including mobile phones and Smart TVs.
"The cybercriminals in control of Kimwolf — a disruptive botnet that has infected more than 2 million devices — recently shared a screenshot indicating they’d compromised the control panel for Badbox 2.0"
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Истовремено, се отстранети сите функционалности за скенирање, експлоатација и brute-force напади.
It reaches exposed Android Debug Bridge services through residential proxy networks, allowing attackers to install malware without authentication.
Bitsight TRACE documented 72.56.52.158 as an "ADB exploitation payload host (port 8002)" and proxybot C2 in an ENS record; ML Cloud's geofeed listed 72.56.52.0/24 as a Riga location.
The Kimwolf operators have also been found to distribute Android APK packages that masquerade as a system service called SystemService, probe for root access, and execute a bundled ELF kernel payload inside.
“pm list packages | grep a.b.c”; “pm install /sdcard/f.apk”; and “am startservice -n a.b.c/.SDKService.”
It reaches exposed Android Debug Bridge services through residential proxy networks, allowing attackers to install malware without authentication.
The earliest dropped sample, targeting the x86 architecture with a Dirty COW exploit, suggests the family evolved from traditional Linux exploitation toward the current ADB-based Android propagation model.
On execution, they probe for root access and execute the embedded ELF kernel...
“TXT records with base64 and XOR encoded information” and “Recreation of the obfuscated code used to deploy the proxybot ELF file.”
Откако ќе се активира, малициозниот софтвер се обидува да се претстави како навидум легитимни Android системски процеси, како што е „netd_service“, за да остане незабележан.
Истовремено, се отстранети сите функционалности за скенирање, експлоатација и brute-force напади.
“the bot masters started executing a local network scan through the proxy command” and “Kimwolf has been scanning local networks at least since the 5th of June.”
Additionally, if all five addresses fail, the botnet falls back to a fixed Tor hidden service address written into the code.
“Beyond the C2 Takedown ... disrupting a botnet’s command-and-control infrastructure was a major step.”
“The primary path for resolution is ENS over Ethereum JSON-RPC. It picks a random public RPC node ... opens TLS to it on port 443, and issues Ethereum eth_call requests.”
“The bot first resolves its C2 from a DNS TXT dead-drop” and “dead drop domains ... update information in their TXT records with base64 and XOR encoded information to give the real backend IPs back to the bot.”
Published third-party research places malware infrastructure in SYSECT-routed prefixes: Kimwolf v7 C2 endpoints in 212.193.31.0/24; an Aisuru-matched sample contacting 147.45.44.34:8001; and a possible Sliver C2 at 89.19.220.70:4443. Bitsight also documented Aisuru/Kimwolf proxy infrastructure in ML Cloud-geofeed-declared ranges.
Ботнетот исто така има за цел да ја направи својата инфраструктура за командување и контрола (C2) поотпорна на обиди за нејзино отстранување, преку повеќеслоен механизам кој користи Ethereum Name Service (ENS) за добивање на C2-адресата, однапред вграден Tor .onion скриен сервис и локален прокси за рутирање меѓу clearnet и Tor.
“This payload opens a raw netcat communication with the IP presented and downloads an APK that is then installed and initiated on the system.”
Користење легитимни јавни Ethereum RPC услуги за пребарување на ENS доменски записи и разрешување на C2 адресите.
“The highest measured bandwidth attack reached 2.3 Tbit/s” and “Attackers are steering their botnets with greater precision and control, generating more traffic in less time.”
“The highest measured bandwidth attack reached 2.3 Tbit/s” and “attackers used a traffic spike against two domains as cover.”
One of the most notable new capabilities in Kimwolf v7 is an HTTP/2 flood powered by the nghttp2 library... constructs complete browser fingerprints. This makes the flood traffic difficult to distinguish from legitimate browser requests.
Kimwolf v7 adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints. This makes attack traffic more difficult to distinguish from legitimate browsing.
88 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
172 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.