Kimwolf v7: An Evolution of the Kimwolf Botnet
Summary: Unit 42 identified Kimwolf v7, a new version of the Android/IoT botnet also tracked as AISURU, adding an HTTP/2 DDoS flood that builds complete browser fingerprints and a three-tier C2 system using five hard-coded public Ethereum RPC endpoints for ENS resolution, a hard-coded Tor .onion fallback, and a local proxy at 127.0.0.1:23075. The botnet spreads by abusing residential proxy services to reach unauthenticated Android Debug Bridge instances on port 5555, and infrastructure analysis found 22 hosts sharing one SSH host key in AS202799, geolocated to Saint Petersburg, Russia, between Dec. 18, 2025 and Feb. 3, 2026.
Bottom line: The operators rebuilt their C2 layer specifically to survive the December 2025 takedowns, and the HTTP/2 flood now mirrors legitimate browser traffic at the protocol and header level, so application-layer DDoS defenses face attack traffic they were not built to separate from real users. Any Android TV box on your network with ADB exposed on port 5555 is a candidate for enrollment without authentication.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026