Kimwolf v7 Adds Browser-Like HTTP/2 DDoS and Resilient C2
Summary
Unit 42 reports that Kimwolf v7 adds browser-like HTTP/2 DDoS flooding and a more resilient C2 setup using ENS, Tor and a local proxy. It targets Android TV boxes and Linux IoT devices; the researchers recommend disabling or restricting ADB.
Key points
- Unit 42 discovered Kimwolf v7 in February 2026 and reports that it uses HTTP/2 floods designed to resemble legitimate browser traffic.
- The malware uses Ethereum Name Service, a hard-coded Tor hidden service and a local proxy for C2 resilience.
- The Kimwolf binary's scanning, exploitation and brute-force modules were removed; the article says propagation was shifted to an external loader.
- The botnet targets Android TV boxes through exposed Android Debug Bridge (ADB), and AISURU targets Linux IoT devices.
- Unit 42 identified Android APKs posing as SystemService that probe for root access and execute bundled ELF payloads.
- Unit 42 recommends treating Android TV boxes as untrusted, segmenting them from enterprise networks, and disabling ADB or restricting it to USB-only access.
Article Details
- Event Type
- Discovery of Kimwolf v7, an updated Android and IoT botnet
- Impact
- Kimwolf v7 adds browser-like HTTP/2 DDoS flooding and more resilient command-and-control routing. It targets Android TV boxes and Linux IoT devices, with ADB abuse identified as a propagation vector. The article reports that the core binary no longer includes scanning, exploitation, or brute-force functionality.
People
Asher DavilaUnit 42 researcher quoted on Kimwolf v7’s HTTP/2-based DDoS flooding and browser fingerprints.Chris NavarreteUnit 42 researcher quoted on Kimwolf v7’s HTTP/2-based DDoS flooding and browser fingerprints.Doel SantosUnit 42 researcher quoted on Kimwolf v7’s HTTP/2-based DDoS flooding and browser fingerprints.
Malware
AisuruResearchers uncovered Kimwolf v7, a new version of the Kimwolf/AISURU Android and IoT botnet that adds browser-like HTTP/2 DDoS flooding and more resilient command-and-control infrastructure.KimwolfResearchers uncovered Kimwolf v7, a new version of the Kimwolf/AISURU Android and IoT botnet that adds browser-like HTTP/2 DDoS flooding and more resilient command-and-control infrastructure.
Products
AndroidResearchers uncovered Kimwolf v7, a new version of the Kimwolf/AISURU Android and IoT botnet that adds browser-like HTTP/2 DDoS flooding and more resilient command-and-control infrastructure.Android Debug BridgeThe botnet typically abuses residential proxy services to reach Android TVs that ship with Android Debug Bridge (ADB) enabled on port 5555 on local networks and install malware capable of conducting DDoS attacks andAndroid TVThe malware now relies on Ethereum Name Service, a hard-coded Tor hidden service, and a local proxy while shifting propagation duties to an external loader and targeting Android TV boxes via ADB.