A Major Evolution of the Kimwolf/AISURU Botnet

Researchers from Palo Alto Networks' Unit 42 published a detailed analysis on August 11, 2026, of a new version of the botnet Kimwolf, also known as AISURU. Tracked as Kimwolf v7, this version introduces significantly stealthier DDoS attack capabilities and a command-and-control (C2) infrastructure designed to withstand takedowns.

Discovered on February 3, 2026, during a threat hunting operation conducted following public disclosures from XLab, Synthient, Infoblox, and Cloudflare, this variant strikes with its increased sophistication. According to researchers Asher Davila, Chris Navarrete, and Doel Santos, “Kimwolf v7 adds an HTTP/2-based DDoS flood that builds complete browser fingerprints. This makes the attack traffic much harder to distinguish from legitimate browsing.”

A Botnet Targeting Android TV Boxes Since 2025

The Kimwolf botnet has been active since at least August 2024, initially targeting IoT Linux devices under the name AISURU. From August 2025, the operators pivoted to Android TV boxes and set-top boxes under the name Kimwolf, reflecting two distinct codebases managed by the same operators: AISURU for Linux IoT variants and Kimwolf for Android variants.

The primary propagation vector exploits residential proxy services to reach unauthenticated Android Debug Bridge (ADB) instances on local networks. Many Android TV boxes come with ADB enabled on port 5555, allowing attackers, once tunneled via a proxy into the local network, to install the malware without any authentication.

The Most Concerning Technique: HTTP/2 Browser Fingerprinting

The most notable feature of Kimwolf v7 is its HTTP/2 flood powered by the nghttp2 library. The function attack_case17_http2_flood builds complete HTTP headers that mimic the behavior of a real Chrome browser, at the protocol and header levels. This technique significantly complicates detection by application DDoS mitigation systems, as the attack traffic becomes nearly indistinguishable from normal browsing requests.

The binary, compiled with the Android NDK via Clang, statically links BoringSSL for TLS operations and nghttp2 for HTTP/2 functionality. At runtime, the malware masks its process name as netd_service to blend in among legitimate Android system processes.

A Three-Tier Anti-Takedown C2 Infrastructure

The C2 infrastructure of Kimwolf v7 has been redesigned to survive the takedown operations that struck the botnet twice in December 2025. The C2 resolution system revolves around three complementary mechanisms:

1. Resolution via Ethereum Name Service (ENS)

The binary contains five public Ethereum RPC endpoints in clear text:

  • 0xrpc.io/eth
  • eth.llamarpc.com
  • ethereum-rpc.publicnode.com
  • eth-protect.rpc.blxrbdn.com
  • eth.merkle.io

These legitimate services are hijacked to query ENS domain records and resolve the C2 address. The endpoints are shuffled via a pseudo-random generator before each resolution attempt, making blocking this technique particularly complex.

The researchers also moderately confidently identified a sixth endpoint likely controlled by the operators: eth.rpcuniverse.com. This domain, registered on December 9, 2023, via Namecheap, exhibits distinct characteristics from legitimate services: no traffic notoriety, a unique IP address on a low-cost VPS, and exclusive presence in Kimwolf binaries.

2. Backup Tor Hidden Service

In case of ENS resolution failure, the binary switches to a hardcoded .onion v3 address (edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd.onion). A state machine (tor_proxy_state_machine) manages the SOCKS5 protocol and the TLS tunnel to this hidden service.

3. Modular Local Proxy

All C2 traffic routes through a local proxy on 127.0.0.1:23075, whether the destination is clearnet or Tor. This modular architecture allows the proxy component to be updated independently of the main bot binary.

An Optimized UDP Flood for ARM Processors

Kimwolf v7 also implements a high-performance UDP flood specifically optimized for ARM processors found in Android TV boxes. This function uses a Xorshift256 pseudo-random generator initialized from /dev/urandom and accelerates the calculation of IP/UDP checksums via ARM NEON SIMD instructions. The vectorized loop processes four 16-bit words simultaneously using VLD1.16, VADDW.U16, and VADD.I32 instructions, reducing the per-packet cost to maximize throughput.

Consolidated DDoS Arsenal: From 43 to 15 Methods

Previous versions of Kimwolf used 43 explicitly named attack methods. Version 7 has consolidated them into 15 numbered methods covering layers 3 to 7 of the OSI model:

Case Function Description
0 TCP socket flood Socket-based TCP flood
3 DNS flood DNS request flood
5 TCP SYN flood TCP SYN flood
12 UDP flood (NEON SIMD) High-performance UDP flood
14 ICMP flood ICMP flood
16 TLS/HTTPS flood TLS flood via BoringSSL
17 HTTP/2 flood HTTP/2 flood with Chrome fingerprints

Cases 8, 11, and 13 are absent, suggesting they are either reserved for future use or removed during consolidation.

Role Separation: Propagation and Attack Divided

A major structural shift in Kimwolf v7 is the removal of all scanning, exploitation, and brute-force modules. This decision indicates that the operators have separated the propagation pipeline from the main payload: an external loader now manages initial access, while the Kimwolf binary focuses on DDoS attacks and proxy relaying.

This specialization reflects operational maturation: the botnet developers have understood that it is more efficient to separate functions to reduce the detection surface of the main binary.

Android APK Variants and Historical Evolution

Alongside standalone ELF payloads, the operators distribute Android APK packages that conceal an ELF kernel payload inside a Java wrapper. Eight APK samples were identified between October and December 2025, all sharing the class systemservice0644.N[redacted]Kernel. These APKs disguise themselves as a SystemService, probe for root access, and execute the embedded ELF kernel.

The historical evolution of the family is revealing:

  • The oldest sample (September 2025) targets the x86 architecture and drops a libcow.so file, likely referencing the privilege escalation vulnerability Dirty COW (CVE-2016-5195).
  • In November 2025, the kernel name changed from libn[redacted]kernel.so to the more discreet libdevice.so, before reverting in December — a sign of active operational security adjustments.

Context: A DDoS Record Attributed to Kimwolf/AISURU

Unit 42's analysis comes in a context where the Kimwolf/AISURU botnet has already made headlines on a large scale. According to a report from Cloudflare published on August 11, 2026, and presented at the Black Hat conference, the company recently mitigated a record attack peaking at 31.4 Tbps and 200 million requests per second, attributed to the AISURU/Kimwolf botnet.

This broader report from Cloudflare on the first half of 2026 mentions 23.2 million DDoS network attacks and 29.64 trillion malicious HTTP requests mitigated. Attacks exceeding 1 Tbps increased by 519% between the first and second quarters, rising from 130 to over 800 incidents.

A Thriving Botnet Landscape

Kimwolf v7 is part of a broader wave of new botnet malware families detected in recent months:

  • AryStinger: enlists old vulnerable home routers for distributed reconnaissance and proxying.
  • RustDuck: hijacks routers, IP cameras, Android boxes, and poorly secured servers for DDoS attacks.
  • NadMesh: combines scanning, exploitation, and intelligence gathering on AI services (Redis, Docker, Kubernetes, Ollama, n8n, etc.) into a standalone platform.
  • Tengu: IoT malware derived from Mirai using Telnet brute-force.

Recommendations and Indicators of Compromise

Unit 42 recommends organizations to monitor several behavioral indicators of Kimwolf compromise on IoT and Android devices:

  • Outgoing HTTPS connections to public Ethereum RPC endpoints from devices that normally do not interact with blockchain services.
  • Establishment of Tor circuits or SOCKS5 proxy traffic from Android TV boxes or IoT devices.
  • Connections to port 23075 on localhost.
  • A process named netd_service running on a mainstream Android device.

Mitigation recommendations include:

  • Treat Android TV boxes as untrusted and segment them from enterprise networks.
  • Disable ADB or restrict it to USB access only, eliminating the primary propagation vector.
  • Monitor unusual Ethereum RPC traffic rather than systematically blocking legitimate endpoints.

The analysis of the C2 infrastructure also revealed that 22 IP addresses in AS202799 (geolocated to Saint Petersburg, Russia) shared the same SSH host key between December 2025 and February 2026, suggesting a centralized hosting infrastructure.

Conclusion

Kimwolf v7 represents a targeted evolution of an already large-scale botnet. The combination of an HTTP/2 flood with Chrome browser fingerprints, a three-tier C2 infrastructure using Ethereum ENS and Tor, and specific ARM optimizations shows that the operators are heavily investing in stealth and resilience. The separation between propagation and attack reflects a growing professionalization of the IoT botnet ecosystem, where each component is specialized to maximize efficiency while minimizing detection risks.

With a record attack already attributed to this botnet and the global DDoS landscape intensifying, vigilance remains crucial against these threats exploiting the proliferation of poorly secured Android TV and IoT devices.