Kimwolf Botnet Adds HTTP/2 Floods and ENS-to-Tor Command Fallback
Summary
Unit 42 says Kimwolf/Aisuru’s latest version uses Chrome-like HTTP/2 floods and Ethereum Name Service lookups, with a Tor fallback, to evade filtering and takedowns. Researchers linked command servers to a network in Saint Petersburg.
Key points
- Unit 42 says the latest Kimwolf/Aisuru version has been active since February, before authorities seized infrastructure used by previous versions.
- Its HTTP/2 flood copies Chrome header order and behavior to make attack traffic resemble normal browsing.
- The malware looks up command addresses through Ethereum Name Service using five public Ethereum services, then falls back to a hardcoded Tor hidden service if those lookups fail.
- Researchers linked four command servers sharing an SSH host key to one network registered in Saint Petersburg, Russia.
- Researchers said it is unclear whether the updated botnet is run by the previous operators or a new group.
- Earlier infrastructure was seized in an international law enforcement operation; a Canadian man alleged to have run the botnet was later arrested and extradited to the United States.
Article Details
- Event Type
- Researchers reported an updated Kimwolf botnet version with a new HTTP/2-based DDoS flood method and changes to its command-and-control resolution.
- Impact
- The botnet uses Chrome-like browser fingerprints to make DDoS traffic harder to distinguish from normal browsing. Its use of Ethereum Name Service lookups and a Tor hidden-service fallback is intended to make its command infrastructure more resistant to disruption and takedowns. Researchers linked command infrastructure to servers in Russia; the article does not identify specific targets or quantify the latest version’s impact.
MITRE ATT&CK
Malware
AisuruPalo Alto Networks’ Unit 42 says the Kimwolf, or Aisuru, botnet has added an HTTP/2-based flood method that uses Chrome-like browser fingerprints to make DDoS traffic look like normal web browsing.KimwolfPalo Alto Networks’ Unit 42 says the Kimwolf, or Aisuru, botnet has added an HTTP/2-based flood method that uses Chrome-like browser fingerprints to make DDoS traffic look like normal web browsing.