A new and significantly improved version of the **Kimwolf/AISURU** Android and Internet of Things (IoT) botnet has been identified, showcasing advanced operational resilience and enhanced capabilities for launching distributed denial-of-service (DDoS) attacks. Tracked as **Kimwolf v7**, this updated botnet was discovered by **Palo Alto Networks Unit 42** in February 2026. "**Kimwolf v7** adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints," noted researchers Asher Davila, Chris Navarrete, and Doel Santos. "This makes attack traffic more difficult to distinguish from legitimate browsing." ### Enhanced C2 Resilience and Attack Sophistication The botnet's command-and-control (C2) infrastructure has been fortified against takedown attempts through a tiered mechanism. This includes the use of **Ethereum Name Service (ENS)** for C2 address resolution, a hard-coded **Tor .onion** hidden service, and a local proxy for routing between clearnet and Tor. Notably, all scanning, exploitation, and brute-force functionalities have been removed from the core payload. This removal suggests that the threat actors have decoupled the propagation pipeline from the core malware. Initial access is now likely handled by an external loader, with the **Kimwolf** binary focusing solely on DDoS attacks and proxy relay operations. **Kimwolf** has historically targeted Android TV boxes since August 2025, while its Linux counterpart, **AISURU**, primarily focuses on Linux IoT devices. The botnet has been active since at least mid-2024. ### Propagation and Obfuscation Techniques The botnet typically leverages residential proxy services to reach Android TVs with **Android Debug Bridge (ADB)** enabled on port 5555 within local networks. Once access is gained, it installs malware capable of conducting DDoS attacks and acting as a relay for malicious traffic. Upon execution, the malware attempts to masquerade as legitimate Android system processes, such as "netd_service," to evade detection. Key new features observed in **Kimwolf v7** include: * Execution of HTTP/2 flood attacks, powered by the **nghttp2** library, which generate full browser fingerprints to mimic legitimate browser behavior at both protocol and header levels. * Utilization of legitimate public Ethereum RPC services to query **ENS** domain records for C2 address resolution. * A backup C2 mechanism employing a hard-coded **Tor .onion** hidden service (e.g., `edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion`). * A local proxy architecture that routes all C2 traffic through `127.0.0[.]1:23075`, regardless of whether it's destined for clearnet or Tor. * A high-performance UDP flood function specifically optimized for **ARM** processors commonly found in Android TV boxes. * Consolidation of DDoS attack commands to 15 numbered methods, a reduction from the 43 text-named methods found in previous versions. ### Evolution from Linux Exploitation to ADB-based Propagation **Kimwolf** operators have also been observed distributing Android APK packages disguised as a system service called **SystemService**. These packages probe for root access and execute a bundled **ELF** kernel payload. Eight such APK artifacts were identified between October and December 2025. "The earliest dropped sample, targeting the x86 architecture with a **Dirty COW** exploit, suggests the family evolved from traditional Linux exploitation toward the current ADB-based Android propagation model," **Unit 42** stated. "The transition from `libn[redacted]kernel.so` to the less conspicuous `libdevice.so` filename in November 2025, followed by a revert in December, indicates active operational security adjustments." ### A Broader Trend of Emerging Botnets This disclosure coincides with the emergence of several other new botnet malware families in recent months: * **AryStinger**: Enlists older, vulnerable home routers for distributed reconnaissance and proxying. * **RustDuck**: Hijacks home routers, IP cameras, Android boxes, and poorly secured servers for DDoS attacks. * **NadMesh**: An autonomous platform that combines scanning, exploitation, and credential/AI-service intelligence harvesting. It targets Redis, Docker, MCP, Kubernetes, ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio instances, drops SSH backdoors, and harvests credentials, environment variables, account tokens, and AWS/Docker configurations. * **Tengu**: A **Mirai**-derived IoT malware that uses Telnet brute-force to compromise IoT devices, enabling DoS attacks, network information gathering, persistence, system metadata exfiltration, command execution, and additional payload downloads, turning infected nodes into proxies. "**Kimwolf v7** is a focused evolution of an already large-scale botnet," **Unit 42** concluded. "Organizations should treat Android TV boxes as untrusted and segment them from enterprise networks. Disabling ADB or restricting it to USB-only access removes the primary propagation vector for this botnet."