Unit 42 Details a More Resilient Kimwolf Variant
Unit 42 says it has identified Kimwolf v7, a new version of the Android and IoT botnet also tracked in earlier Linux activity as AISURU. The variant focuses less on self-spreading code and more on stronger DDoS capability, command-and-control resilience and traffic that can be harder to separate from normal browsing. The findings matter for organizations that allow consumer Android TV boxes or other low-trust IoT devices onto enterprise networks.Android TV Boxes Are the Main Kimwolf Target
Kimwolf v7 primarily affects Android TV boxes and set-top boxes, according to Unit 42. The researchers say the broader botnet family has been active since August 2024, first under the AISURU name against Linux IoT systems before shifting toward Android TV boxes around August 2025.That distinction is useful for defenders because Unit 42 describes two related codebases under the same operators: AISURU for Linux IoT variants and Kimwolf for Android-focused variants. The newer Android path is tied to exposed Android Debug Bridge access on local networks, with attackers misusing residential proxy services to reach devices that should not be reachable without authentication. The practical implication is simple: low-cost media boxes can become network risk assets if they are treated as harmless peripherals.
HTTP/2 DDoS Traffic Mimics Browser Behavior
The most visible capability change in Kimwolf v7 is an HTTP/2 flood that constructs complete browser fingerprints. Unit 42 says this can make attack traffic more difficult to distinguish from legitimate browser requests at the protocol and header level.The analyzed sample is a statically linked ARM ELF binary built with the Android Native Development Kit, using BoringSSL for TLS operations and nghttp2 for HTTP/2 functionality. Unit 42 also says the dispatch table supports 15 DDoS methods across Layers 3-7, with some method slots absent and likely removed or reserved. For defenders, the point is not only traffic volume. Application-layer controls may also need to evaluate behavioral baselines from Android and IoT devices that do not normally generate browser-like HTTP/2 patterns.
ENS and Tor Add C2 Redundancy
Kimwolf v7 uses a three-tier command-and-control resolution design intended to survive takedown efforts, Unit 42 reports. The binary includes five hard-coded public Ethereum RPC endpoints that are misused to resolve Ethereum Name Service domains and obtain C2 addresses.Unit 42 says the malware shuffles those endpoints before resolution attempts, adding redundancy without requiring the operators to control each public service. The same research also describes a hard-coded Tor hidden service as a fallback when ENS resolution fails, plus a local proxy architecture that can route C2 traffic through clearnet or Tor. The defensive lesson is narrower than blocking blockchain services outright: unusual Ethereum RPC traffic or Tor-style routing from Android TV boxes is a stronger signal than the mere existence of legitimate public infrastructure.
Infrastructure Clustering Points to Rapid Rebuilds
Unit 42 connects the v7 design to earlier disruption. The report says domain takedowns affected the botnet twice in December 2025, after which Kimwolf developers added Tor backup routing and other resilience features.The researchers also observed several C2 hosts that shared the same SSH host key. Pivoting on that key revealed 22 IP addresses in the same range between Dec. 18, 2025, and Feb. 3, 2026, all geolocated by Unit 42 to Saint Petersburg, Russia. A separate RPC-looking domain was assessed with moderate confidence as operator-controlled because of its dedicated hosting pattern, timing and presence in Kimwolf binaries, though Unit 42 says it cannot confirm domain ownership. This kind of clustering helps defenders track infrastructure relationships even when individual domains or servers disappear.
Variant Changes Suggest a Split Malware Pipeline
Kimwolf v7 appears more specialized than earlier builds. Unit 42 says the authors consolidated the attack count to 15 numbered methods and removed scanning, exploitation and brute-force functionality from the analyzed bot payload.That does not make the botnet less serious. The change suggests the operators may have separated initial access from DDoS execution, with external loaders handling infection while the Kimwolf binary handles attack traffic and proxy relay. Unit 42 also found Android APK variants from October through December 2025 that bundled ELF payloads inside Java wrappers and masqueraded as system services. For enterprise teams, this argues for device inventory and segmentation rather than relying only on malware detection at the perimeter.
Defensive Signals for Android and IoT Networks
The strongest defensive indicators in Unit 42's report are behavioral. Android TV boxes and IoT devices should not normally initiate blockchain RPC lookups, Tor routing activity or suspicious local proxy patterns, and consumer Android devices should not run a process masquerading as a core network service.Unit 42 recommends monitoring for unusual Ethereum RPC traffic from IoT and Android devices instead of broadly blocking legitimate public RPC endpoints. The report also advises treating Android TV boxes as untrusted, segmenting them from enterprise networks and disabling or tightly restricting ADB access. These controls reduce the chance that a compromised media device becomes a foothold for botnet traffic inside a corporate or government environment.
Conclusion
Kimwolf v7 is not just another incremental malware build. Unit 42's analysis shows a botnet variant shaped by prior disruption, with browser-like HTTP/2 DDoS traffic, ENS-based C2 resolution, Tor fallback routing and Android-focused deployment.The main risk is the gap between how consumer IoT devices are perceived and how they behave when compromised. If Android TV boxes sit on trusted networks with unnecessary services exposed, they can become durable DDoS nodes and C2 clients. The practical response is disciplined asset control: isolate these devices, remove unnecessary remote debugging access and watch for network behavior that does not match their expected role.
Sources
Editorial Team - CoinBotLab
