Kimwolf v7 Botnet Evolves with HTTP/2 DDoS and Blockchain C2
The Kimwolf Android/IoT botnet has been updated to version 7, featuring enhanced DDoS capabilities using HTTP/2 and a more resilient command-and-control infrastructure that leverages Ethereum Name Service and Tor.
Palo Alto Networks' Unit 42 has identified a significant evolution in the Kimwolf botnet, now in its seventh iteration (v7). This sophisticated malware primarily targets Android TV boxes and set-top boxes, expanding its distributed denial-of-service (DDoS) attack capabilities and bolstering its command-and-control (C2) resilience. The latest version introduces an HTTP/2-based DDoS flood that meticulously crafts complete browser fingerprints, making its malicious traffic far more difficult to distinguish from legitimate user browsing.
Kimwolf v7's C2 infrastructure represents a notable upgrade in its evasion tactics. The malware now utilizes the Ethereum Name Service (ENS), a blockchain-based naming system, for resolving C2 addresses. The binary contains five hard-coded public Ethereum RPC endpoints, which it misuses to query ENS records. This layered approach makes traditional domain takedown efforts significantly more challenging for security researchers and law enforcement.
Further enhancing its survivability, Kimwolf v7 also incorporates a hard-coded Tor .onion hidden service as a backup C2 channel. This is complemented by a local proxy architecture that allows for flexible routing between the clearnet and the Tor network. This dual-layer C2 strategy, combining ENS and Tor, was reportedly added in response to successful C2 server takedowns that occurred in December 2025, demonstrating the malware operators' adaptability.
The botnet's propagation method remains a key vector for its spread. Kimwolf exploits misconfigured residential proxy services to gain access to unauthenticated Android Debug Bridge (ADB) instances present on local networks. Many Android TV boxes ship with ADB enabled by default on port 5555, creating an easy entry point for attackers who can tunnel through a proxy endpoint to install the malware without requiring any authentication.
Technically, the Kimwolf v7 sample analyzed is a statically linked ARM ELF binary, compiled using the Android NDK with Clang and Bionic libc. It leverages BoringSSL for TLS operations and the nghttp2 library for its new HTTP/2 functionality. The malware authors continue a concerning trend of embedding racial slurs within their code, though Unit 42 has partially redacted these in their reporting to aid researchers in identifying indicators of compromise (IoCs) while mitigating the spread of offensive language.
Kimwolf, also tracked as AISURU, has been active since August 2024, initially targeting Linux IoT devices before transitioning to Android TV boxes around August 2025. This indicates two distinct codebases maintained by the same operators. The malware's ability to mask its process name as 'netd_service' further aids its stealth, allowing it to blend in with legitimate Android system processes.
The introduction of the HTTP/2 flood with sophisticated browser fingerprint spoofing is a critical enhancement, enabling more potent and stealthier DDoS attacks. By mimicking legitimate browser headers, the botnet can overwhelm targets with traffic that bypasses basic signature-based detection methods.
Organizations should remain vigilant for unusual Ethereum RPC traffic originating from IoT and Android devices, as this could indicate a Kimwolf infection. While blocking the public RPC endpoints is not recommended due to their legitimate use, monitoring for anomalous patterns is crucial. The layered C2 infrastructure, combining ENS, Tor, and potentially operator-controlled endpoints, presents a significant challenge for defenders seeking to disrupt the botnet's operations.