Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
Summary: Palo Alto Networks Unit 42 discovered Kimwolf v7 in February 2026, a new version of the Kimwolf/AISURU Android and IoT botnet that adds an HTTP/2-based DDoS flood constructing complete browser fingerprints so attack traffic is harder to distinguish from legitimate browsing. The botnet now uses a tiered command-and-control mechanism with Ethereum Name Service to obtain the C2 address, a hard-coded Tor .onion hidden service, and a local proxy routing between clearnet and Tor, while removing all scanning, exploitation, and brute-force functionality.
Key Takeaway: Kimwolf has targeted Android TV boxes since August 2025, reaching them through residential proxy services and ADB exposed on port 5555, and Unit 42 identified eight APK artifacts masquerading as a system service called SystemService between October and December 2025. Attack traffic that carries complete browser fingerprints and C2 that resolves through ENS and Tor removes two of the signals defenders have relied on to spot both the flood and the infrastructure behind it.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026