AISURU/Kimwolf
Aisuru/Kimwolf is a distributed denial-of-service (DDoS) botnet family used for large-scale attacks. The content describes Aisuru and Aisuru-Kimwolf as having compromised approximately 1-4 million hosts globally, and attributes record-setting DDoS activity to the botnet, including an attack peaking at 31.4 Tbps and 14.1 billion packets per second. Aisuru is noted to randomize packet characteristics to complicate detection, and to encode command-and-control IP addresses in TXT DNS records associated with its C2 domains. KimWolf is described as an Android-specific subvariant of Aisuru that reuses Aisuru DDoS functionality modified for Android devices, targeting Android-based systems including smart TVs and mobile devices; KimWolf alone is said to have compromised about 2 million devices globally. The operators reportedly monetized access to compromised devices via Discord and Telegram, used the IPIDEA residential proxy network to mask activity, and KimWolf was later reported to have shifted to I2P after takedown actions. The U.S. Department of Justice announced disruption actions on March 19, 2026 targeting command-and-control infrastructure used by the Aisuru and KimWolf botnets, including actions in Canada and Germany and attempted seizure of DigitalOcean droplets used as KimWolf C2 servers.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Command and Control
3 techniques
Command and Control
Spamhaus noted that July to December 2025 saw a 24% increase in the number of botnet command & control servers identified... law enforcement attempted to take down Command and Control infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets.
IOCs tracked for this family
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Large-scale botnet family used for record-setting DDoS attacks. It can randomize packet characteristics to hinder detection, encodes C2 IPs in DNS TXT records, and has been monetized by selling access to compromised devices to other cybercriminals.
Large-scale DDoS botnet ecosystem (including Android variant Kimwolf) attributed to hyper-volumetric HTTP DDoS activity; also monetized via proxy bandwidth and other services (per excerpted headlines).
A large-scale HTTP/network-layer DDoS botnet reported to have compromised over 2 million Android devices (notably off-brand Android TVs) and used to launch hyper-volumetric DDoS attacks, including a 31.4 Tbps event and the campaign dubbed 'The Night Before Christmas.'
A large-scale DDoS botnet responsible for hyper-volumetric HTTP and network-layer DDoS attacks; reported to have compromised/ensnared over 2 million Android devices (notably off-brand Android TVs), leveraging residential proxy networks for traffic and potentially command-and-control reachability.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.