Kimwolf Botnet Rebuilds for Resilience, Evading Takedowns with HTTP/2 and Blockchain C2
The Kimwolf botnet has resurfaced with advanced evasion techniques, including HTTP/2 flood mimicking legitimate traffic and a decentralized command-and-control infrastructure leveraging the Ethereum Name Service.
The developers behind the Kimwolf botnet, primarily composed of compromised Android TV boxes and other IoT devices, have released a significantly updated version designed to evade detection and thwart law enforcement takedowns. Palo Alto Networks' Unit 42 threat intelligence group reported that this new iteration has been active since February 2026, shortly before authorities seized infrastructure associated with earlier versions.
The most notable technical advancement is the botnet's adoption of an HTTP/2 flood method for its Distributed Denial of Service (DDoS) attacks. Unlike cruder flood attacks that send raw packets, this new version meticulously mimics the traffic patterns and header fingerprints of the Google Chrome web browser. This sophisticated imitation makes it exceedingly difficult for defensive systems to distinguish malicious bot traffic from legitimate user activity, forcing targeted servers to either withstand overwhelming traffic or risk blocking genuine customers.
To enhance resilience against takedowns, Kimwolf's command and control (C2) infrastructure has been decentralized and moved beyond traditional domain registrar controls. The malware now retrieves its C2 server addresses from the Ethereum Name Service (ENS), a decentralized naming system built on the Ethereum blockchain. By storing C2 information on an immutable ledger distributed across numerous nodes, the botnet becomes significantly harder to disrupt through standard legal means like domain seizure.
The malware is programmed to query five different public ENS addresses, shuffling their order with each attempt to further complicate blocking efforts. This approach eliminates a single point of failure and removes the possibility of serving law enforcement orders to a central registrar. Furthermore, the botnet incorporates a fallback mechanism, reverting to a hardcoded Tor hidden service address if ENS lookups fail, adding another layer of anonymity and obfuscation for its C2 operations.
Infrastructure analysis by Unit 42 suggests that the C2 servers powering this new Kimwolf variant are located in Russia, with four identified servers sharing a common SSH host key and residing within a single network registered in Saint Petersburg. It remains unclear whether the new development team is directly linked to the original creators of Kimwolf or if it represents a new threat actor capitalizing on the botnet's established notoriety.
Kimwolf originally emerged as a splinter from the Aisuru DDoS botnet, gaining significant attention in late 2025 when it briefly topped Cloudflare's global domain rankings. Its previous infrastructure was targeted in a coordinated international law enforcement operation in March 2026, which led to the seizure of its C2 servers and the subsequent arrest of an individual alleged to be operating the botnet.
This evolution of Kimwolf underscores a broader trend in botnet development: the increasing sophistication in evading detection and the adoption of decentralized technologies to resist takedowns. The use of ENS and Tor demonstrates a strategic shift away from easily disruptable centralized C2 models, presenting new challenges for cybersecurity professionals and law enforcement agencies aiming to dismantle such operations.