Who Benefited from the Aisuru and Kimwolf Botnets?
Summary: KrebsOnSecurity reported that the Kimwolf botnet infected more than two million unofficial Android TV streaming boxes, and that XLab found definitive evidence the same actors and infrastructure deployed both Kimwolf and the earlier Aisuru botnet, confirmed on December 8 when both were distributed from the same Internet address, 93.95.112[.]59. That address range is assigned to Resi Rack LLC, a Lehi, Utah company whose co-founder Cassidy Hales said it received a December 10 notification about a customer's use of its servers and took care of the issue immediately, while Synthient tracked at least seven static Resi Rack IP addresses connected to Kimwolf proxy infrastructure between October and December 2025.
What you should know: The botnet's operators moved their control instructions to Ethereum Name Service text records, which XLab said cannot be blocked, so takedowns of individual control servers no longer stop the infected devices from finding new instructions; a Telegram post claimed Dort and Snow now control 3.5 million infected devices.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026