Forest Global Training Partners

Cyber Risks · Krebs on Security

Kimwolf Botnet Lurking in Corporate, Govt. Networks

Summary: The Kimwolf IoT botnet has spread to more than 2 million devices, forcing them into distributed denial-of-service attacks and other malicious traffic, and it spreads by tricking residential proxy services into relaying commands that scan the local networks of proxy endpoints. Infoblox found nearly 25 percent of its customers made a query to a Kimwolf-related domain since October 1, 2025, and Synthient counted at least 33,000 affected internet addresses at universities and colleges and nearly 8,000 IPIDEA proxies inside U.S. and foreign government networks.

Bottom line: Spur found residential proxies in nearly 300 government-owned networks, 318 utility companies, 166 healthcare companies or hospitals, and 141 banking and finance companies, with co-founder Riley Kilmer noting many of the government networks were Department of Defense - meaning an infected phone or laptop on your network can give an attacker a foothold to pivot from.

Read the original at Krebs on Security ↗

Topics
Malware
Related