The Kimwolf Botnet is Stalking Your Local Network
Summary: Synthient is tracking more than 2 million Kimwolf-infected devices worldwide, concentrated in Vietnam, Brazil, India, Saudi Arabia, Russia and the United States, with two-thirds being Android TV boxes that ship with no security or authentication. The botnet spreads by tunneling back through residential proxy networks into local networks, a weakness researcher Benjamin Brundage found exploited by setting DNS records to RFC-1918 addresses like 192.168.0.1, and by early December 2025 he had identified a one-to-one overlap between new Kimwolf infections and proxy IP addresses rented by China-based IPIDEA.
Key Takeaway: Brundage watched Kimwolf rebuild from almost nothing to two million infected systems in a couple of days by tunneling through IPIDEA's proxy pool, which advertises access to more than 100 million residential proxy endpoints - so the firewall and router protecting your internal network may no longer be the boundary you assume it is.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026