Cybersecurity experts have identified a new iteration of the Kimwolf/AISURU Android and IoT botnet, revealing significant enhancements in its ability to execute distributed denial-of-service (DDoS) attacks. Dubbed Kimwolf v7, this version was uncovered by Palo Alto Networks Unit 42 in February 2026.
Advanced DDoS Techniques
Kimwolf v7 has introduced an HTTP/2-based DDoS mechanism that fabricates complete browser fingerprints, making it harder to differentiate attack traffic from genuine web browsing, according to researchers Asher Davila, Chris Navarrete, and Doel Santos. This development complicates efforts to identify and mitigate such malicious activities.
In addition to refining its attack strategies, the botnet has fortified its command-and-control (C2) infrastructure. It uses a multi-layered approach, incorporating the Ethereum Name Service (ENS) to acquire C2 addresses, a hard-coded Tor .onion hidden service, and a local proxy to facilitate traffic routing between clearnet and Tor.
Structural Changes and Targets
Significantly, the latest version has dispensed with its scanning and exploitation modules, indicating a shift in strategy where initial propagation tasks are outsourced to external loaders. This change allows the core Kimwolf binary to focus on conducting DDoS attacks and acting as a proxy relay.
Since August 2025, Kimwolf has primarily targeted Android TV boxes, exploiting their Android Debug Bridge (ADB) vulnerabilities. Meanwhile, its Linux counterpart, AISURU, targets Linux-based IoT devices. The botnet exploits residential proxy services to access Android TVs with ADB enabled on port 5555, installing malware capable of DDoS attacks and relaying malicious traffic.
Notable Features and Security Implications
Key features of Kimwolf v7 include the capability to execute HTTP/2 flood attacks powered by the nghttp2 library, creating browser fingerprints to imitate legitimate activity. It also utilizes public Ethereum RPC services to resolve ENS domain records for C2 addresses.
The botnet’s C2 strategy includes a backup mechanism using a hard-coded Tor .onion hidden service, and a local proxy architecture that directs all C2 traffic, whether to clearnet or Tor, through a specific localhost address. Additionally, it boasts a high-performance UDP flood function targeting ARM processors in Android TV boxes.
The Kimwolf operators have been distributing Android APKs disguised as system services, probing for root access, and deploying embedded ELF kernel payloads. This evolution from traditional Linux exploits to an ADB-based Android model underscores ongoing operational adjustments.
Emerging Threats and Recommendations
This revelation coincides with the discovery of other botnet malware families, such as AryStinger, RustDuck, NadMesh, and Tengu, each employing unique methods to compromise devices and networks.
Unit 42 emphasizes that Kimwolf v7 represents a deliberate evolution of a large-scale botnet. Organizations are advised to treat Android TV boxes as untrusted devices, segment them from enterprise networks, and disable or restrict ADB to USB-only access to mitigate the primary propagation vector.
