Emerging ThreatsMalware & Ransomware

Kimwolf Botnet Evolves with Enhanced DDoS Capabilities

Analyst 207||Source: Unit42
Technicians walk by rows of server racks and networking equipment in a modern network operations center.
Kimwolf v7 was discovered on Feb. 3, 2026 — and its binary contains five hard‑coded public Ethereum RPC endpoints the malware uses to resolve command-and-control addresses via ENS, a blockchain naming system, making C2 resolution unusually resilient.

What Kimwolf v7 is and where it came from

Palo Alto Networks’ Unit 42 traced the Kimwolf family (also tracked as AISURU) to activity that began in August 2024. The malware initially targeted Linux IoT devices under the AISURU name and transitioned to Android TV boxes and set‑top boxes around August 2025 under the Kimwolf name. Unit 42 describes two parallel codebases under the same operators: AISURU for Linux IoT builds and Kimwolf for Android targets.

Technical advances: HTTP/2, browser fingerprints, and ARM optimizations

Kimwolf v7 is a statically linked ARM ELF binary compiled with the Android NDK. It links BoringSSL for TLS and nghttp2 to implement an HTTP/2 flood capability that constructs complete browser fingerprints (the function named attack_case17_http2_flood). That header and protocol construction is designed to make application‑layer DDoS traffic resemble legitimate browser requests, complicating mitigation.

The bot also implements a high‑performance UDP flood that uses a Xorshift256 PRNG seeded from /dev/urandom (with a SplitMix64 fallback) and accelerates IP/UDP checksum computation with ARM NEON SIMD instructions. Those vectorized loops are tailored to the ARM processors common in Android TV hardware to maximize packet throughput.

Command-and-control resilience: ENS, an operator RPC, Tor, and a local proxy

Unit 42 identified a layered C2 resolution system in v7. The binary contains five plaintext public Ethereum RPC endpoints it shuffles with a PRNG before each ENS query: hxxps[:]//0xrpc[.]io/eth; hxxps[:]//eth.llamarpc[.]com; hxxps[:]//ethereum-rpc.publicnode[.]com; hxxps[:]//eth-protect.rpc.blxrbdn[.]com; and hxxps[:]//eth.merkle[.]io. These legitimate RPC services are misused to resolve ENS records to C2 addresses.

Two samples also hard‑code a sixth endpoint, eth[.]rpcuniverse[.]com, which Unit 42 assesses with moderate confidence is operator controlled: the rpcuniverse domain resolves to a single low‑cost VPS IP (23.94.221[.]104), lacks global traffic ranking, and the hosting pattern differs from the multi‑tenant anycast providers used by the other RPC endpoints. When ENS resolution fails, the binary falls back to a hard‑coded Tor .onion hidden service (edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion) and routes all C2 traffic through a local proxy at 127.0.0.1:23075, allowing independent updates to the proxy component.

Propagation, packaging, and operational changes

Kimwolf spreads by abusing residential proxy services to reach unauthenticated Android Debug Bridge (ADB) instances inside local networks — many Android TV boxes ship with ADB enabled on port 5555. The operators appear to have separated the propagation function from the attack payload: v7 removed scanning, exploitation, and brute‑force modules and focuses on attack and proxy relay duties. External loaders now appear responsible for initial access.

Operators distribute Android APK wrappers that drop an embedded ELF kernel payload. Unit 42 found multiple APKs (October–December 2025) that masquerade as a system service (SystemService or com.android.logcatd) and execute embedded kernels such as libdevice.so or previous libn[redacted]kernel.so. The wrappers host the C2 resolution layer while the kernel handles lower‑level bot functions and process masquerading (e.g., renaming to TVHelper or inetd).

Infrastructure findings: clustered IPs and operator host details

Unit 42 observed C2 connections to IPs including 212.193.31[.]119, 212.193.31[.]122 (TCP port 13) and 212.193.31[.]92, 212.193.31[.]158 (TCP port 443). Pivoting on a shared SSH host key revealed 22 IP addresses presenting the identical key between Dec. 18, 2025 and Feb. 3, 2026; those hosts reside in AS202799 and are geolocated to Saint Petersburg, Russia. The rpcuniverse operator host (23.94.221[.]104, AS36352 RackNerd, Dallas) served the rpcuniverse[.]com subdomains that appear in some Kimwolf samples and presented a Let’s Encrypt certificate observed on that IP between Dec. 13, 2023 and March 12, 2024.

What this means for technologists, enterprises, and end users

  • Technologists and security teams: watch for outbound HTTPS to public Ethereum RPC endpoints from IoT and Android devices, Tor SOCKS5 or circuit establishment on consumer devices, and local connections to 127.0.0.1:23075; look for processes named netd_service on consumer Android devices as a behavioral indicator.
  • Affected enterprises and procurement leaders: treat Android TV boxes as untrusted network attachments and segment them from enterprise networks; disable ADB or restrict it to USB‑only access to remove the primary propagation vector identified by Unit 42.
  • End users and the general public: devices that normally do not interact with blockchain services contacting Ethereum RPC endpoints or exhibiting unusual proxy/Tor traffic are potential signs of compromise; consider isolating smart TVs and set‑top boxes from sensitive networks.

Kimwolf v7 is not a radically new concept so much as a deliberate refinement: a narrower attack payload optimized for ARM devices, an HTTP/2 flood that mimics browsers, and a multi‑tier C2 design built to survive takedowns. The split between external loaders and a hardened attack/proxy binary makes detection and disruption more complex — defenders will need to monitor atypical blockchain RPC usage, Tor activity, and local proxy connections to spot compromised devices.

Read the original Unit 42 analysis: https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/

AisuruAndroidBlockchainBotnetDdosEmerging ThreatsLinuxIot SecurityMalware OperationsKimwolf BotnetENS
Related Intelligence

Continue Reading

Technicians work in a network operations center with rows of computer servers and networking equipment.

Kimwolf Botnet Evolves to Evade DDoS Detection

The Kimwolf botnet has levelled up its game with a new upgrade, v7, which uses HTTP/2 floods to mimic real browser traffic, making it super tricky to detect as a DDoS attack. This sneaky move lets the botnet build complete browser fingerprints, blurring the line between legit and malicious traffic.

Analyst 207
Windows computer workstation on a clean office desk with a blank laptop screen.

Microsoft Patches Zero-Day Windows Driver Flaw Under Active Attack

Microsoft just patched a high-severity Windows driver flaw, known as CVE-2026-68820, that was already being exploited by hackers in the wild. This zero-day vulnerability, with a CVSS score of 7.0, could be triggered by a race condition, allowing attackers to gain a foothold in targeted systems.

Analyst 207
A laptop sits alone on a table in front of a blurred background of computer workstations and servers.

CAV3RN Espionage Framework Evolves With Google Apps Script C2 Relay

Meet the sneaky CAV3RN Espionage Framework, which just got a clever upgrade - it can now use Google Apps Script as a relay to secretly communicate with its controllers, all while hiding in plain sight within DNS traffic. This clever tactic lets the malware decide on a per-transaction basis whether to connect directly to its masters or take a detour through Google's services.

Analyst 207
Head Mare APT Exploits Unpatched TrueConf Servers to Deliver PhantomCore Malware

Head Mare APT Exploits Unpatched TrueConf Servers to Deliver PhantomCore Malware

In a sneaky move, the Head Mare group exploited unpatched TrueConf servers to spread PhantomCore malware, using a chain of vulnerabilities to swap out legitimate client installers with infected ones. This allowed them to secretly deliver a backdoor to unsuspecting meeting participants.

Analyst 207