Kimwolf v7 Botnet Masks DDoS Attacks as Legitimate HTTP/2 Traffic
New Android botnet disguises DDoS attacks as browser traffic, evading detection.
1Discovery of Kimwolf v7
Palo Alto Networks Unit 42 researchers identified a new Android and IoT botnet, Kimwolf v7, in February 2026. This version includes significant enhancements to improve operational resilience and execute distributed denial-of-service (DDoS) attacks. The botnet employs an HTTP/2-based DDoS flood mechanism that constructs complete browser fingerprints, making attack traffic nearly indistinguishable from legitimate browsing activity.
2Advanced Command-and-Control Infrastructure
Kimwolf v7 utilizes a tiered mechanism to bolster its command-and-control (C2) infrastructure resilience. It leverages Ethereum Name Service (ENS) to obtain C2 addresses, incorporates a hardcoded Tor .onion hidden service, and uses a local proxy for routing between clearnet and Tor. Notably, all scanning, exploitation, and brute-force functionalities have been removed, indicating threat actors have separated the propagation pipeline from the core payload.
3Targeted Devices and Propagation Method
Since August 2025, Kimwolf has primarily targeted Android TV boxes, while its Linux counterpart AISURU focuses on Linux IoT devices. The botnet abuses Android Debug Bridge (ADB) enabled on port 5555 in local networks to reach Android TVs. The installed malware can conduct DDoS attacks and relay malicious traffic. To evade detection, the malware masquerades as legitimate Android system processes like 'netd_service'.
4APK Packages and Root Access Probes
Kimwolf operators distribute Android APK packages disguised as a system service called SystemService. These packages probe for root access and execute a bundled ELF kernel payload. Eight such APK artifacts were identified between October-December 2025. The earliest sample targeted x86 architecture using Dirty COW exploit, showing the botnet's evolution from traditional Linux exploitation to ADB-based Android propagation.
5Operational Security Adjustments
In November 2025, the botnet transitioned from libn[redacted]kernel.so to the less conspicuous libdevice.so filename, only to revert this change in December. These dynamic modifications demonstrate active operational security adjustments by threat actors to avoid detection. Such continuous evolution confirms Kimwolf as an advanced persistent threat requiring sophisticated countermeasures.
6Broader Botnet Threat Landscape
Kimwolf v7's emergence coincides with detection of multiple new botnet malware families in recent months. This trend necessitates reevaluation of IoT and Android device security postures. Android TV boxes should be treated as untrusted devices in enterprise networks. Disabling ADB or restricting it to USB-only access eliminates the botnet's primary propagation vector while implementing HTTP/2 traffic monitoring enhances detection capabilities.
7Enterprise Protection Recommendations
Palo Alto Networks Unit 42 recommends organizations segment Android TV boxes from enterprise networks and disable ADB or restrict it to USB-only access. Network monitoring should include HTTP/2 traffic anomaly detection, and DDoS protection solutions require updating to address this evolving threat. These measures not only counter Kimwolf but also similar advanced botnets. Proactive device security policies and network segmentation remain critical defenses.
8Kimwolf v7's Significance and Implications
Kimwolf v7 represents a focused evolution of an already large-scale botnet operation. Its HTTP/2 implementation and advanced obfuscation techniques pose new challenges for cybersecurity teams. By targeting widely used Android TV and IoT devices, it highlights critical vulnerabilities in consumer and enterprise environments. Organizations must adopt proactive device security measures and network segmentation to mitigate risks from Kimwolf and comparable advanced persistent threats.
Original article: The Hacker News — Kimwolf v7 Botneti HTTP/2 ile Gerçek Trafik Taklidi Yapıyor