Kimwolf v7 Botnet Hides DDoS Attacks Behind Chrome Fingerprints and Ethereum

A botnet that has already infected more than two million Android TV boxes and streaming devices has resurfaced with a sharper edge. Researchers at Palo Alto Networks’ Unit 42 have identified Kimwolf v7, a new version of the Kimwolf/AISURU botnet that pairs a browser-mimicking DDoS flood with a three-layer command-and-control system designed to shrug off takedowns.

Unit 42 discovered the v7 sample on February 3, 2026, while hunting for indicators in the wake of public disclosures from XLab, Synthient, Infoblox, and Cloudflare.

The most notable addition is an HTTP/2 flood, powered by the nghttp2 library, that constructs complete browser fingerprints matching Chrome traffic. Because the attack traffic mirrors legitimate browsing at both the protocol and header level, it becomes far harder for defenders to filter using conventional rate-limiting or fingerprint-based mitigation.

Kimwolf v7 Botnet Hides DDoS Attacks Behind Chrome

The malware also consolidated its arsenal, moving from 43 text-named attack commands in earlier builds down to 15 numbered methods spanning OSI layers 3 through 7, including TCP SYN/ACK/RST floods, DNS floods, an ICMP flood, a TLS/HTTPS flood using BoringSSL, and a high-performance UDP flood accelerated with ARM NEON SIMD instructions tuned specifically for the processors found in cheap Android TV boxes.

Kimwolf’s operators suffered two disruptions to their C2 infrastructure in December 2025, and v7 reads like a direct response. The binary now resolves its command server through a three-tier system.

First, it queries five hard-coded, legitimate public Ethereum RPC endpoints, including 0xrpc.io and eth.llamarpc.com, to resolve Ethereum Name Service (ENS) domain records that point to the actual C2 address, shuffling the order with a pseudo-random generator before each attempt.

If that fails, the malware falls back to a hard-coded Tor v3 .onion hidden service. All C2 traffic, whether destined for the clearnet or Tor, is routed through a local proxy on 127.0.0.1:23075, allowing operators to update the proxy component independently of the main bot binary [web:2].

Unit 42’s infrastructure analysis also uncovered a likely operator-controlled Ethereum RPC facade, eth.rpcuniverse.com, hosted on a dedicated single-tenant VPS registered in December 2023, a detail that suggests the operators built their own fallback disguised as a public blockchain service.

Perhaps the most telling architectural change is what Kimwolf v7 no longer does. The sample strips out all scanning, exploitation, and brute-force capability that earlier versions carried.

Unit 42 assesses this as evidence that the operators have split their operation into two pipelines: external loaders now handle initial infection through unauthenticated Android Debug Bridge (ADB) instances exposed on port 5555, while the Kimwolf binary itself is dedicated purely to launching attacks and acting as a proxy relay.

This mirrors reporting from Synthient earlier this year, which found the botnet spreading by tunneling through abused residential proxy networks straight into home networks that would otherwise be shielded by a router.

Researchers traced 22 C2 IP addresses that shared an identical SSH host key, all within AS202799 and geolocated to Saint Petersburg, Russia.

The first host carrying that key appeared on December 18, 2025, with the rest rolling out over the following six weeks a pattern consistent with a single operator scaling out infrastructure incrementally rather than renting scattered, disconnected hosts.

Alongside standalone ELF payloads, Kimwolf’s operators distribute APK packages that masquerade as a generic “SystemService,” probe for root access, and unpack an embedded ELF “kernel” binary.

Unit 42 traced the family’s lineage back to an early x86 sample using the Dirty COW exploit (CVE-2016-5195), evidence that the botnet evolved from traditional Linux exploitation before pivoting entirely to ADB-based Android propagation.

A brief rename of the payload file from a slur-laden filename to the more innocuous libdevice.so in November 2025, followed by a revert in December, suggests operators were actively tweaking their operational security on the fly.

Unit 42 recommends organizations watch for outbound HTTPS connections to public Ethereum RPC endpoints from devices that have no business touching blockchain infrastructure, Tor circuit establishment from IoT or Android TV devices, traffic to localhost port 23075, and a process named netd_service running on consumer hardware.

The broader guidance is blunt: treat Android TV boxes as untrusted endpoints, segment them from enterprise networks, and either disable ADB entirely or restrict it to USB-only access, since it remains the primary door Kimwolf uses to walk through.

The botnet’s scale is already staggering. Cloudflare attributed a record 31.4 Tbps attack lasting 35 seconds to the AISURU/Kimwolf family, and law enforcement in Germany, the US, and Canada disrupted portions of the network in a March 2026 operation. Kimwolf v7 suggests that disruption bought only a partial reprieve; the underlying platform has come back leaner, quieter, and considerably harder to kill.

Site: Thecyberdef.com

Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.