"Kimwolf v7 adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints," researchers Asher Davila, Chris Navarrete, and Doel Santos said. That single sentence, published by Palo Alto Networks Unit 42, captures the technical pivot at the heart of a recent upgrade to the long-running Kimwolf/AISURU botnet family.
HTTP/2 floods that mimic real browsers
Unit 42 discovered the new variant, tracked as Kimwolf v7, in February 2026. The most striking change is an HTTP/2-based distributed denial-of-service (DDoS) capability that uses the nghttp2 library and assembles "complete browser fingerprints" at the protocol and header level. According to the researchers, this allows attack traffic to mirror legitimate browser behavior, making it harder to distinguish malicious flows from normal user traffic.
The v7 binary consolidates DDoS commands into 15 numbered methods, down from 43 text-named methods observed in prior versions, and adds a high-performance UDP flood function tuned specifically for ARM processors commonly used in Android TV boxes.
Resilient command-and-control: ENS, Tor, and a localhost proxy
Kimwolf v7 moves to a tiered command-and-control (C2) architecture intended to resist takedown. The botnet uses legitimate public Ethereum RPC services to query Ethereum Name Service (ENS) records to resolve C2 addresses. If that mechanism fails, the binary contains a hard-coded Tor .onion hidden service — edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion — as a backup.
All C2 traffic, whether routed to clearnet or Tor, is sent through a local proxy at 127.0.0[.]1:23075, the researchers reported. This local proxy architecture and the ENS/Tor combination create multiple resolution and routing layers that complicate straightforward C2 takedown or sinkholing efforts.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePropagation split: loaders for access, Kimwolf for DDoS and proxying
Unit 42 notes a deliberate change in how the operators handle propagation. Kimwolf v7 removes scanning, exploitation, and brute-force functionality from the binary, a move the researchers interpret as the operators splitting the propagation pipeline from the core payload. Initial access and device compromise appear to be offloaded to external loaders; the Kimwolf binary itself focuses on executing DDoS tasks and acting as a relay.
The botnet has been active since at least mid-2024. Kimwolf is known to target Android TV boxes since August 2025, while AISURU, the Linux counterpart, focuses on Linux IoT devices. The operation typically abuses residential proxy services to reach Android TVs that ship with Android Debug Bridge (ADB) enabled on port 5555 on local networks, installing malware that both conducts DDoS attacks and relays malicious traffic.
Operators have also been observed distributing Android APK packages posing as a system service called SystemService that probe for root access and execute a bundled ELF kernel payload. Unit 42 identified eight such APK artifacts dated between October and December 2025. The earliest dropped sample targeted x86 using a Dirty COW exploit, a detail Unit 42 used to trace the family’s evolution from traditional Linux exploitation toward the current ADB-based Android propagation model. The researchers also called out filename changes — from libn[redacted]kernel.so to libdevice.so and back — as evidence of active operational-security adjustments.
Related botnets and the broader IoT threat landscape
Unit 42 published the Kimwolf v7 findings alongside a wider set of recent IoT threats. The report noted several other families active in the same timeframe:
- AryStinger — enlists older, vulnerable home routers into a network for distributed reconnaissance and proxying.
- RustDuck — hijacks home routers, IP cameras, Android boxes, and poorly secured servers to build a DDoS-capable network.
- NadMesh — combines scanning, exploitation, and credential/AI-service intelligence harvesting into an autonomous platform designed to scan for Redis, Docker, MCP, Kubernetes, ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio instances, drop an SSH backdoor, and harvest credentials, environment variables, account tokens, and AWS and Docker configurations.
- Tengu — a Mirai-derived IoT malware that uses Telnet brute-force to hijack IoT devices, run instructions for DoS, gather network configuration, set up persistence, exfiltrate metadata, execute commands, download payloads, and turn infected nodes into proxies.
What this means for technologists, procurement teams, and end users
Technologists and security teams: Unit 42 recommends treating Android TV boxes as untrusted and segmenting them from enterprise networks. The researchers explicitly advise disabling ADB or restricting it to USB-only access to remove the botnet’s primary propagation vector.
Procurement and operations leaders: Devices that ship with ADB enabled or that are reachable through residential-proxy-assisted paths represent elevated risk. The observed use of ENS resolution and Tor fallbacks suggests C2 resilience strategies that will complicate remediation and tracking; procurement decisions should factor in device manageability and ability to restrict local services such as ADB.
End users and administrators of home or small-office networks: The distribution of APKs masquerading as SystemService and the use of proxy services to reach port 5555 underline the value of checking device defaults and disabling unnecessary developer interfaces.
Kimwolf v7 is not merely a new payload; it is a redesign that emphasizes stealth, resilience, and modularity. By stripping scanning from the core binary, hardening C2 resolution with ENS and Tor, and making DDoS traffic resemble legitimate browser activity at the HTTP/2 layer, the operators have raised the technical bar for detection and disruption. As Unit 42 concluded, network segmentation and disabling ADB remain the most concrete, source-backed mitigations available today.
