Loading story…
Lumen Technologies’ Black Lotus Labs reported disrupting the AISURU/Kimwolf botnet ecosystem by null-routing/dropping traffic to more than 550 command-and-control (C2) nodes and IPs linked to the botnets’ backend infrastructure since early October 2025. The operation targeted two closely related, financially motivated botnets—AISURU and its Android-focused counterpart Kimwolf—that have become major sources of DDoS activity and residential proxy abuse, with Kimwolf drawing attention after a related domain briefly surged to the top of Cloudflare’s global domain rankings before being removed from the list.
Researchers assessed Kimwolf as having compromised over 2 million devices, largely unofficial/unsanctioned Android TV streaming boxes, leveraging exposed Android Debug Bridge (ADB) services and tunneling through residential proxy networks to expand access and maintain control. Reporting also described Kimwolf’s use of proxy monetization (including attempts to offload proxy bandwidth for upfront cash) and noted that the operators reacted to disruption efforts with provocative messaging embedded in DDoS payloads; observed DDoS patterns were often short bursts (1–2 minutes) but sometimes extended for hours, with gaming services (e.g., Minecraft) cited as a common target category.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
On January 14, 2026, public reporting disclosed that Black Lotus Labs had null-routed traffic to more than 550 command-and-control nodes tied to the AISURU and Kimwolf botnets, detailing their DDoS-for-hire and residential proxy abuse operations.
During the four-month disruption effort, Lumen shared findings on infrastructure linked to Canadian IP addresses with law enforcement as operators repeatedly rebuilt command-and-control systems within hours.
By late 2025, researchers assessed that Kimwolf had likely exceeded 1.8 million infections and compromised more than 2 million unofficial Android TV devices overall, making it one of the largest observed Android botnets.
In late October 2025, Kimwolf drew major attention after briefly becoming the top-ranked domain in Cloudflare's global rankings, reflecting the botnet's sudden scale and visibility.
By mid-October 2025, Lumen estimated Kimwolf had grown to roughly 800,000 infected devices within weeks of emerging, driven by exploitation of vulnerable residential proxy services.
Since October 1, 2025, Infoblox observed that nearly 25% of its cloud customers queried a Kimwolf domain, which researchers said indicated broad scanning activity even if not confirmed compromise.
In early October 2025, researchers observed infrastructure changes consistent with Kimwolf's emergence. The botnet rapidly expanded by abusing residential proxy services and exposed ADB services to compromise unofficial Android TV devices.
Beginning in early October 2025, Lumen Technologies' Black Lotus Labs started blocking and null-routing command-and-control infrastructure associated with Kimwolf and AISURU, eventually targeting more than 550 nodes.
Lumen's Black Lotus Labs observed a surge in bot traffic to AISURU command-and-control infrastructure in September 2025, indicating growing activity from the botnet before Kimwolf's emergence.
In September 2025, Cloudflare reported that the AISURU botnet generated a 29.7 Tbps distributed denial-of-service attack lasting 69 seconds, highlighting the scale of the broader botnet ecosystem tied to Kimwolf.
Researchers said Kimwolf splintered from the Aisuru botnet in August 2025, marking the emergence of a distinct Android-focused botnet linked to the same ecosystem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcecyberscoop.com
Open sourcethehackernews.com
Open sourcelinkedin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The Kimwolf botnet has rapidly infected over 1.8 million Android-based devices worldwide, with security researchers warning that the true number may exceed 2 million. The malware primarily targets Android TV boxes, digital photo frames, and other IoT devices, many of which are distributed through major online retailers and often ship with weak security controls or pre-installed malicious software. Kimwolf leverages advanced techniques such as DNS-over-TLS, blockchain-based command and control via Ethereum Name Service (ENS), and residential proxy networks to evade detection and takedown efforts. The botnet enables attackers to launch high-volume DDoS attacks, monetize proxy bandwidth, and conduct lateral movement within local networks, posing a significant threat to both enterprise and consumer environments. Security experts have identified that two-thirds of Kimwolf infections are Android TV boxes lacking basic authentication, making them especially vulnerable. The operators behind Kimwolf, previously linked to the Aisuru botnet, are known for their technical sophistication and rapid adaptation to takedown attempts. Their monetization strategies include ad fraud, DDoS-for-hire services, and the resale of residential proxy bandwidth. The malware often spreads through bundled mobile apps and games, exploiting the global supply chain of low-cost Android devices. Organizations and individuals are urged to identify, isolate, and remediate infected devices to prevent further exploitation and participation in criminal infrastructure.
Jun 29, 2026
Security researchers reported explosive growth of the **Kimwolf** botnet to **2+ million infected devices** globally, with heavy concentrations including Vietnam, Brazil, India, Saudi Arabia, Russia, and the United States. Synthient assessed that roughly **two-thirds of infections are insecure Android TV boxes**, and described Kimwolf’s primary impact as large-scale abuse traffic (ad fraud, account takeover attempts, scraping) and **high-capacity DDoS** capable of disrupting major websites for extended periods. A key concern is Kimwolf’s propagation method: leveraging **residential proxy networks** to effectively tunnel “back” into home/SMB networks via proxy endpoints and then infect additional devices that users assume are protected behind NAT/firewalls and consumer routers. KrebsOnSecurity further tied operational activity to the botnet controller, a threat actor using the handle **“Dort,”** who allegedly retaliated against a vulnerability discloser and the journalist with **DDoS, doxing, email flooding**, and an apparent **SWATing** incident. Open-source and commercial intelligence cited in the reporting linked “Dort” to historical aliases (e.g., **CPacket**, **M1ce**) and to accounts on cybercrime forums, and noted prior involvement in enabling abuse tooling (e.g., CAPTCHA-bypass code and temporary email services) and presence in communities associated with cybercrime groups (including references to **LAPSUS$** chat activity).
Jun 29, 2026
The **Kimwolf** “Internet of Things” botnet has been linked to major disruption of the anonymity network **I2P (Invisible Internet Project)** after botnet operators began using I2P to help evade takedown efforts against their command-and-control (C2) servers. I2P users reported that tens of thousands of new “routers” suddenly flooded the network, many unable to pass traffic, overwhelming I2P to the point that legitimate users could not connect; developers and users described extreme connection counts and a sharp drop in successful connections consistent with a large-scale availability attack. Separately, a major U.S. ISP reported actively **sinkholing/blocking traffic to hundreds of botnet C2 servers** associated with Kimwolf (and the related **Aisuru** botnet), citing more than **550** identified C2 endpoints over several months. Reporting attributes Kimwolf’s growth to at least **~2 million infected devices**, with operators leveraging compromised **Android TV set-top boxes** and scanning for exposed **Android Debug Bridge (ADB)** services to expand the botnet and monetize access via **residential proxy** infrastructure that makes malicious traffic appear to originate from consumer networks.
Jun 29, 2026