ByteConnect
ByteConnect is a proxy software development kit (SDK) used to monetize compromised devices by converting them into residential proxy nodes. Reporting describes it being delivered to victims—primarily unsanctioned/gray-market Android TV streaming devices—either directly or via sketchy apps that come pre-installed on the devices. It is specifically cited in connection with the AISURU/Kimwolf Android botnet ecosystem, where infections are monetized by installing third-party proxy SDKs such as ByteConnect (also referenced as “Plainproxies Byteconnect”) to resell victim bandwidth.
In observed cases, devices running/connecting to ByteConnect’s SDK were used to relay malicious traffic; one mention notes that after connecting to ByteConnect’s SDK, researchers observed a mass influx of credential-stuffing attacks originating through the proxying activity.
No additional high-confidence technical indicators (e.g., package names, hashes) are provided in the content beyond the name/alias and its use as a proxy SDK delivered via preinstalled or sketchy Android apps in the Kimwolf context.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malicious/abused SDK used in the Kimwolf ecosystem to convert infected Android devices into residential proxies for relaying traffic.
Software development kit delivered to compromised Android devices to enable residential proxy functionality (turning infected devices into proxy endpoints).
Residential proxy/monetization SDK installed on Kimwolf-compromised devices to turn them into Internet traffic relays; observed being used to facilitate abusive activity including credential-stuffing against email servers and popular websites.
Third-party residential proxy/bandwidth monetization SDK observed being installed on Kimwolf-compromised devices, enabling bandwidth resale and facilitating abuse such as credential-stuffing via proxying.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.