Threat Research · unit42.paloaltonetworks.com

Unit 42 Details Kimwolf v7 Botnet’s HTTP/2 DDoS and Resilient C2

Aug 11, 2026 · Original article ↗

Summary

Unit 42 analyzes Kimwolf v7, an Android/IoT botnet targeting TV boxes. It adds HTTP/2 DDoS traffic with browser fingerprints and resilient C2 using ENS, Tor and a local proxy; researchers also detail ADB propagation and infrastructure.

Key points

Unit 42 says it identified Kimwolf v7 on Feb. 3, 2026, through threat hunting following earlier public disclosures.
The botnet targets Android TV boxes and set-top boxes; the article describes propagation through residential proxies to reach unauthenticated Android Debug Bridge instances.
The v7 malware adds HTTP/2 DDoS traffic that builds browser fingerprints, and its dispatch table includes 15 DDoS methods across network layers.
C2 resolution uses five public Ethereum RPC endpoints to query ENS, with a Tor hidden-service fallback and a local proxy routing C2 traffic.
Researchers linked 22 hosts in the same address range through a shared SSH host key; they assess a separate RPC facade as likely operator-controlled but cannot confirm domain ownership.
The malware removed scanning, exploitation and brute-force functions; researchers suggest external loaders may now handle propagation.
The article recommends disabling or restricting ADB and segmenting Android TV boxes from enterprise networks.

Article Details

Attack Vectors: Kimwolf reaches unauthenticated Android Debug Bridge (ADB) instances on local networks through residential proxy services, then installs itself without authentication.
Kimwolf v7 launches Layer 3–7 DDoS floods, including an HTTP/2 flood that constructs browser-like fingerprints and headers to blend attack traffic with normal browsing.
The malware resolves C2 addresses through ENS using hard-coded Ethereum RPC endpoints, with a hard-coded Tor hidden service as a fallback and a local proxy relaying C2 traffic.
Android APK variants disguise themselves as the SystemService service, probe for root access, and execute an embedded ELF kernel payload.
Defensive Notes: Disable ADB on Android TV boxes or restrict it to USB-only access, and segment these devices from enterprise networks.
Monitor for unusual Ethereum RPC traffic from IoT and Android devices, Tor circuit establishment or SOCKS5 proxy traffic, connections to localhost port 23075, and a netd_service process on consumer Android devices.
The article says Advanced WildFire, Advanced URL Filtering, Advanced DNS Security, and Device Security provide protections relevant to this activity.

Indicators of compromise

Type	Indicator	Context
DOMAIN	`avax[.]rpcuniverse[.]com`	RPC subdomain resolving to the same host as the operator-associated rpcuniverse[.]com infrastructure.
DOMAIN	`eth[.]rpcuniverse[.]com`	Hard-coded in Kimwolf samples as an additional RPC endpoint; the article assesses with moderate confidence that it is an operator-controlled facade, while noting ownership could not be confirmed.
DOMAIN	`rpcuniverse[.]com`	Domain associated with the RPC facade assessed with moderate confidence as operator-controlled; it resolves to the host contacted by Kimwolf samples.
IPV4	`212[.]193[.]31[.]102`	Kimwolf C2 host identified as the first host in the shared-SSH-key infrastructure cluster.
IPV4	`212[.]193[.]31[.]119`	IP address observed receiving Kimwolf C2 traffic on TCP port 13.
IPV4	`212[.]193[.]31[.]122`	IP address observed receiving Kimwolf C2 traffic on TCP port 13.
IPV4	`212[.]193[.]31[.]158`	IP address observed receiving Kimwolf C2 traffic, including HTTPS C2 traffic on port 443.
IPV4	`212[.]193[.]31[.]92`	IP address observed receiving Kimwolf HTTPS C2 traffic on port 443.
IPV4	`23[.]94[.]221[.]104`	Host for the RPC facade associated with Kimwolf; ELF and APK samples contacted this IP address directly.
MD5	`036bcb62be72c4663b9564955f93b05f`	MD5 hash of a Kimwolf v7 ELF bot payload.
MD5	`33faca1e0090f6b12eff703daf4606e4`	MD5 hash of a Kimwolf v7 ELF bot payload that hard-codes eth.rpcuniverse[.]com.
MD5	`d759364844d78a728505fb0485c3adbc`	MD5 hash of the analyzed Kimwolf v7 ELF bot payload.
SHA1	`2a1d96f1b066877812587ac94f45f82dfff5f5f9`	SHA-1 thumbprint of the self-signed certificate used to sign the identified Kimwolf Android samples.
SHA256	`2ec2e85b0358e0c681cb5067489a9086ec97dbbf7e3c952dd9cd496b319d5af5`	SHA-256 hash of a Kimwolf v7 ELF bot payload that hard-codes eth.rpcuniverse[.]com.
SHA256	`345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49`	SHA-256 hash of a Kimwolf v7 ELF bot payload.
SHA256	`406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ff`	SHA-256 hash of the analyzed Kimwolf v7 ELF bot payload.
SHA256	`421111a57b0a4224c052fa4108d90429d579974b5b5111ed2e58516ba09422ca`	SHA-256 hash of an x86 ELF kernel payload dropped by a Kimwolf APK variant.
SHA256	`8242443dfcec66e3fe04cbfa2fbd211ad34065ee07aa93813d792a437caab212`	SHA-256 hash of the libdevice.so ARM ELF kernel payload associated with Kimwolf.
SHA256	`9470c68f9b6fe5f90d61891b95623afd7b4298815b0f95e25610e1c09008dc24`	SHA-256 hash of an ARM ELF kernel payload dropped by Kimwolf APK variants.
SHA256	`951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36`	SHA-256 hash of a Kimwolf Android APK variant that contacts 23.94.221[.]104.
SHA256	`f07821e313c16cbbd82def45094a22c8d474164051bdbc7648d6869e012014b4`	SHA-256 hash of a Kimwolf Android APK variant that contacts 23.94.221[.]104.
SHA256	`f3e8a55a2a3ea7c7b6676e90f4f49a2c55b13065b68ee50c51cc35fe2b5c3237`	SHA-256 TLS certificate hash associated with eth.rpcuniverse[.]com, which the article assesses with moderate confidence as an operator-controlled RPC facade.