Kimwolf v7 Evolves to Evade Detection in DDoS Attacks

Unit 42 researchers have uncovered a new version of the Kimwolf/AISURU botnet that appears engineered for stealth and resilience, marking a tactical shift in how the malware conducts distributed denial-of-service (DDoS) attacks. Dubbed Kimwolf v7, the variant was identified in February 2026 and introduces an HTTP/2-based flood that mimics legitimate browser behavior, making it harder for defenders to spot malicious traffic.

HTTP/2 Floods and Browser Mimicry

The most notable change in Kimwolf v7 is its DDoS methodology. According to Palo Alto Networks Unit 42, the botnet now employs an HTTP/2 flood powered by the nghttp2 library, constructing complete browser fingerprints that mirror real browsing at the protocol and header level. This effectively blurs the line between attack traffic and normal user activity.

“This makes attack traffic more difficult to distinguish from legitimate browsing,” the researchers noted. The approach is a departure from earlier versions, which relied on simpler methods, and reflects a broader trend among botnets to evade sophisticated detection systems.

Hardened Command-and-Control Infrastructure

Beyond the flood technique, Kimwolf v7 has overhauled its command-and-control (C2) architecture. The botnet now uses a tiered mechanism that leverages Ethereum Name Service (ENS) to resolve C2 addresses via public Ethereum RPC services. This is complemented by a hard-coded Tor .onion hidden service – specifically edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion – and a local proxy that routes all C2 traffic through 127.0.0[.]1:23075, regardless of whether it heads to clearnet or Tor.

The shift is a deliberate effort to make the C2 infrastructure more resistant to takedown, a common challenge for botnet operators. By distributing the address resolution across ENS and Tor, the botnet reduces reliance on a single point of failure.

Streamlined Attack Methods

The new version also consolidates its DDoS attack commands to 15 numbered methods, down from 43 text-named commands in earlier versions. This simplification likely improves operational efficiency and reduces the attack surface for defenders. Additionally, Kimwolf v7 removes all scanning, exploitation, and brute-force functionality, indicating that the operators have split the propagation pipeline from the core payload, relying on an external loader for initial access.

Targeting Android TV Boxes

Kimwolf has been known to target Android TV boxes since August 2025, with its Linux counterpart, AISURU, focusing on Linux IoT devices. The botnet has been active since at least mid-2024. It typically abuses residential proxy services to reach Android TVs that ship with Android Debug Bridge (ADB) enabled on port 5555 on local networks, allowing it to install malware capable of conducting DDoS attacks and acting as a relay to ferry malicious traffic.

Once launched, the malware attempts to mask itself as legitimate Android system processes, such as “netd_service”, to evade detection. The new version also includes a high-performance UDP flood function specifically targeting ARM processors found in Android TV boxes.

APK Masquerade and Root Exploitation

Unit 42 has observed that Kimwolf operators distribute Android APK packages that masquerade as a system service called SystemService. These APKs probe for root access and execute a bundled ELF kernel payload. Between October and December 2025, eight such APK artifacts were identified.

“The earliest dropped sample, targeting the x86 architecture with a Dirty COW exploit, suggests the family evolved from traditional Linux exploitation toward the current ADB-based Android propagation model,” the researchers said. They also noted that “The transition from libn[redacted]kernel.so to the less conspicuous libdevice.so filename in November 2025, followed by a revert in December, indicates active operational security adjustments.”

Rise of New Botnet Families

The disclosure comes amid a surge of new botnet malware families detected in recent months. These include AryStinger, which enlists older, vulnerable home routers into a network for distributed reconnaissance and proxying; RustDuck, which hijacks home routers, IP cameras, Android boxes, and poorly secured servers for DDoS attacks; NadMesh, a multi-functional botnet that scans for various services and harvests credentials; and Tengu, a Mirai-derived malware that uses Telnet brute-force to hijack IoT devices.

Recommendations for Organizations

Unit 42 offers concrete advice for defenders: “Organizations should treat Android TV boxes as untrusted and segment them from enterprise networks. Disabling ADB or restricting it to USB-only access removes the primary propagation vector for this botnet.”

“Kimwolf v7 is a focused evolution of an already large-scale botnet,” Unit 42 said. “Organizations should treat Android TV boxes as untrusted and segment them from enterprise networks. Disabling ADB or restricting it to USB-only access removes the primary propagation vector for this botnet.”

— Palo Alto Networks Unit 42

Why It Matters

The evolution of Kimwolf v7 underscores the increasing sophistication of IoT botnets, which are becoming more adept at blending in with legitimate traffic and resisting takedown efforts. For organizations, this means that devices like Android TV boxes can no longer be overlooked as potential entry points for attacks. If these devices are not properly secured, they could serve as a launchpad for DDoS attacks that are harder to detect and mitigate. The move toward HTTP/2 and ENS-based C2 also suggests that botnet operators are adapting to modern defenses, raising the bar for security teams to monitor and respond to emerging threats.