"The malware now looks up its command address in the Ethereum Name Service, a directory that lives on the Ethereum blockchain."
HTTP/2 floods crafted to look like real Chrome traffic
Researchers at Palo Alto Networks' Unit 42 report that the newest Kimwolf (also tracked as Aisuru) release replaces crude packet floods with an HTTP/2-based method that imitates full browser behavior. Instead of firing raw packets, infected devices issue requests that carry "full browser fingerprints," copying header order and the behavior of the Chrome web browser. Because most web traffic today runs over HTTP/2, Unit 42 warns that this makes the attack traffic far harder to distinguish from legitimate visitors.
That distinction is critical: the usual defense against distributed denial-of-service (DDoS) attacks is to drop or block traffic identified as automated. When bot traffic closely mirrors Chrome, defensive tools face a painful choice, the report says: serve every request and risk overload, or deny traffic and turn away legitimate customers the site cannot tell apart from the bots.
Command-and-control shifted to Ethereum Name Service and Tor
Unit 42's report documents a second, structural change meant to blunt law enforcement takedowns. Previous Kimwolf variants baked a command server domain name into the malware—an address registrars and investigators could seize. The new build instead looks up its command address in the Ethereum Name Service (ENS), a blockchain-hosted directory whose records are stored across thousands of nodes.
The malware carries five public ENS records and "shuffles the order before each attempt," the report says, complicating blocking efforts. If all five ENS lookups fail, the bot falls back to a fixed Tor hidden service address encoded in the code. Tor resolves that address through its own network and hides where the server actually sits, leaving investigators without the conventional domain or host to serve with a law-enforcement order.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageInfrastructure indicators: four servers shared an SSH host key in one Saint Petersburg network
Unit 42's infrastructure analysis located the machines powering the command structure in Russia. The report states that four of the command servers shared an SSH host key, and that further analysis found the servers "sit in one network registered in Saint Petersburg." The researchers note it is unclear whether the authors of this new version are the same people behind previous Kimwolf iterations or a new actor exploiting the botnet's notoriety.
Recent disruptions, a splintering history, and an arrest
Kimwolf splintered from the record-setting Aisuru DDoS botnet last year and drew broad attention when it briefly topped Cloudflare's global domain rankings in late October 2025. An international law enforcement operation disrupted previous Kimwolf versions in March, seizing infrastructure that had powered the botnet. In May, a Canadian man alleged to run the botnet was arrested and extradited to the United States, the report notes.
Unit 42 says the newest build had been active "since February," about a month before the March infrastructure seizure. The team did not respond to CyberScoop's request for comment, according to the published report.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Expect DDoS traffic that leverages HTTP/2 and chrome-like fingerprints to evade conventional packet-level filters. Defenders will need detection tuned to application-layer patterns and to accept harder tradeoffs between availability and user-permissioning when attack traffic is indistinguishable from genuine browsers.
- Policymakers and regulators: The shift to ENS—and the fallback to Tor—removes familiar administrative levers such as registrar seizure and single-company contact points for law enforcement orders. That change complicates takedown strategies that rely on controlling domain registries or contacting hosting providers.
- Affected enterprises and service operators: Sites under attack face a stark choice echoed in the report: serve every request and risk service failure, or start turning away traffic and potentially exclude legitimate customers who cannot be separated from bots that mimic browsers.
Kimwolf's rebuild shows how quickly an established botnet can adapt from network-layer floods to application-layer mimicry while moving its command channels into decentralized and privacy-preserving systems. Unit 42's findings leave open a central question: when botnet authors adopt blockchain-based directories and Tor fallbacks, how must investigators retool takedown playbooks to regain leverage?
