Content Warning
We are providing a content warning because the following article contains usage of a racial slur by a threat actor, which Unit 42 does not condone in any instance. We have partially redacted the racial slur, but preserved some references to it in order to provide researchers with the ability to identify it and check IoCs as needed.
Executive Summary
We identified a new version (v7) of the Kimwolf Android/internet-of-things (IoT) botnet. This version upgrades its distributed denial-of-service (DDoS) attack capabilities and the resilience of its command-and-control (C2) infrastructure. Kimwolf primarily affects Android TV boxes and set-top boxes.
Kimwolf v7 adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints. This makes attack traffic more difficult to distinguish from legitimate browsing.
The threat’s binary includes five hard-coded public Ethereum-based endpoints for resolving Ethereum Name Service (ENS) domains. ENS is a blockchain-based naming system used to obtain C2 addresses.
Kimwolf also carries a hard-coded Tor .onion hidden service as a backup and a local proxy architecture for flexible routing between clearnet and Tor. The malware developers added this function to directly respond to C2 server takedown efforts in December 2025.
We discovered this variant on Feb. 3, 2026, through threat hunting that followed public disclosures by XLab, Synthient, Infoblox, Cloudflare and others.
Palo Alto Networks customers are better protected through the following products and services:
If you think you might have been compromised or have an urgent matter, contact the Unit 42 Incident Response team.
| Related Unit 42 Topics | Malware, Botnet, DDoS |
Background
The Kimwolf botnet (also tracked as AISURU) has been active since August 2024. It initially targeted Linux IoT devices under the AISURU name. The botnet transitioned to Android TV boxes around August 2025.
This reflects two separate codebases under the same operators. AISURU covers the Linux IoT variants, and Kimwolf covers variants targeting Android.
Kimwolf spreads by misusing residential proxy services to reach unauthenticated Android Debug Bridge (ADB) instances on local networks. Some Android TV boxes ship with ADB enabled on port 5555. Once attackers tunnel through a proxy endpoint into the local network, they can install the malware without any authentication.
Kimwolf Sample Overview
The Kimwolf sample we analyzed as a baseline is a statically linked ARM Executable and Linkable Format (ELF) binary. The file was compiled with the Android Native Development Kit (NDK) using Clang and uses Bionic libc. It statically links BoringSSL for Transport Layer Security (TLS) operations and nghttp2 for HTTP/2 functionality.
The binary is stripped but retains some symbol information. It is not uncommon for malware authors to use racial slurs in their code. The Kimwolf malware family has historically included racial slurs. In our discussion of the v7 variant, we have partially redacted these slurs, but have left enough information present that defenders could identify the variant and check for IoCs.
Previous Kimwolf builds used the internal version strings such as n[redacted]boxv4 and n[redacted]boxv5, establishing the naming pattern for the family. The version string n[redacted]boxv7, shown in Figure 1, identifies this sample as version 7. The binary creates a Unix domain socket @n[redacted]boxv7 to ensure only one instance runs at a time.
We identified six ELF samples that we clustered together based on multiple indicators:
- They share an identical ELF section layout produced by a common Android NDK build environment, and the same hard-coded set of Ethereum remote procedure call (RPC) endpoints
- Overlapping C2 infrastructure within the same hosting provider
- Consistent process-name masquerading behavior
HTTP/2 Flood with Browser Fingerprint Spoofing
One of the most notable new capabilities in Kimwolf v7 is an HTTP/2 flood powered by the nghttp2 library. The function that performs the attack_case17_http2_flood constructs complete browser fingerprints. This makes the flood traffic difficult to distinguish from legitimate browser requests.
Figure 2 shows the header construction logic in the decompiled binary.
Three-Tier C2 Infrastructure
Kimwolf v7 uses a layered C2 resolution system designed to survive the domain takedowns that disrupted the botnet twice in December 2025.
This isn't the last time operation of this malware faced disruption. On March 19, 2026, the U.S. Justice Department and international partners announced a court-authorized operation that seized C2 infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad botnets.
| Case number | Function | Description |
| 0 | attack_case0_tcp_socket_flood | TCP socket-based flood |
| 1 | attack_case1_udp_flood_v1 | UDP flood variant 1 |
| 2 | attack_case2_game_server_udp | Game server UDP flood (port 27015) |
| 3 | attack_case3_dns_flood | DNS query flood |
| 4 | attack_case4_udp_flood_v2 | UDP flood variant 2 |
| 5 | attack_case5_tcp_syn_flood | TCP SYN flood |
| 6 | attack_case6_tcp_ack_flood | TCP ACK flood |
| 7 | attack_case7_tcp_synack_flood | TCP SYN-ACK flood |
| 9 | attack_case9_udp_async_flood | Asynchronous UDP flood |
| 10 | attack_case10_tcp_rst_flood | TCP RST flood |
| 12 | udp_flood_attack | High-performance UDP flood (NEON SIMD) |
| 14 | attack_case14_icmp_flood | ICMP flood |
| 15 | attack_case15_tcp_connection_flood | epoll-based TCP connection flood |
| 16 | attack_case16_tls_https_flood | TLS/HTTPS flood (BoringSSL) |
| 17 | attack_case17_http2_flood | HTTP/2 flood with Chrome fingerprints (nghttp2) |
| SHA256 Hash | Filename | Architecture |
| 9470c68f9b6fe5f90d61891b95623afd7b4298815b0f95e25610e1c09008dc24 | libn[redacted]kernel.so | ARM |
| 8242443dfcec66e3fe04cbfa2fbd211ad34065ee07aa93813d792a437caab212 | libdevice.so | ARM |
| 421111a57b0a4224c052fa4108d90429d579974b5b5111ed2e58516ba09422ca | libn[redacted]kernel.so (v1) | x86 |