Kimwolf v7: An Evolution of the Kimwolf Botnet
Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing.
Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. We identified a new version (v7) of the Kimwolf Android/internet-of-things (IoT) botnet. Kimwolf primarily affects Android TV boxes and set-top boxes. Kimwolf v7 adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints.
AISURU covers the Linux IoT variants, and Kimwolf covers variants targeting Android. The earliest dropped sample , targeting the x86 architecture with a Dirty COW exploit , suggests the family evolved from traditional Linux exploitation toward the current ADB-based Android propagation model. Disabling ADB or restricting it to USB-only access removes the primary propagation vector for this botnet.
The file was compiled with the Android Native Development Kit (NDK) using Clang and uses Bionic libc. SHA256 hash: 406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ff MD5 hash: d759364844d78a728505fb0485c3adbc File size: 1,720,108 bytes File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf v7 bot payload (baseline analyzed sample); version string n[recacted]boxv7 SHA256 hash: 345222bca004595
The botnet transitioned to Android TV boxes around August 2025. Kimwolf spreads by misusing residential proxy services to reach unauthenticated Android Debug Bridge (ADB) instances on local networks. Some Android TV boxes ship with ADB enabled on port 5555. The Kimwolf sample we analyzed as a baseline is a statically linked ARM Executable and Linkable Format (ELF) binary.
What changed
Justice Department and international partners announced a court-authorized operation that seized C2 infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad botnets.
External loaders now handle initial access while the Kimwolf binary handles attacks and proxy relay.
The HTTP/2 flood with Chrome browser fingerprinting complicates application-layer DDoS mitigation, as attack traffic now mirrors legitimate browser behavior at the protocol and header level.
Who is affected
On execution, the malware masks its process name as netd_service to blend in with legitimate Android system processes.
Kimwolf v7 uses a layered C2 resolution system designed to survive the domain takedowns that disrupted the botnet twice in December 2025 .
Organizations should monitor for unusual Ethereum RPC traffic from IoT and Android devices rather than blocking these endpoints outright.
However, the dedicated single-tenant hosting, the timing of its registration relative to Kimwolf activity and its exclusive presence in Kimwolf binaries suggest it is an operator-controlled facade rather than a public service.
2, 2025) is notable for two reasons: The libdevice.so sample renames its process to TVHelper , which explicitly targets Android TV set-top boxes by mimicking a legitimate TV helper service.
Organizations should monitor for the following behavioral indicators of Kimwolf compromise on IoT and Android devices: Organizations should treat Android TV boxes as untrusted and segment them from enterprise networks.
Why this matters
AISURU covers the Linux IoT variants, and Kimwolf covers variants targeting Android.
The earliest dropped sample , targeting the x86 architecture with a Dirty COW exploit , suggests the family evolved from traditional Linux exploitation toward the current ADB-based Android propagation model.
Disabling ADB or restricting it to USB-only access removes the primary propagation vector for this botnet.
The technical picture
The file was compiled with the Android Native Development Kit (NDK) using Clang and uses Bionic libc.
SHA256 hash: 406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ff MD5 hash: d759364844d78a728505fb0485c3adbc File size: 1,720,108 bytes File type: ELF 32-bit LSB executable, ARM, statically linked, stripped File description: Kimwolf v7 bot payload (baseline analyzed sample); version string n[recacted]boxv7 SHA256 hash: 345222bca004595
How organizations are responding
The botnet transitioned to Android TV boxes around August 2025.
Kimwolf spreads by misusing residential proxy services to reach unauthenticated Android Debug Bridge (ADB) instances on local networks.
Some Android TV boxes ship with ADB enabled on port 5555.
The Kimwolf sample we analyzed as a baseline is a statically linked ARM Executable and Linkable Format (ELF) binary.
The Kimwolf malware family has historically included racial slurs.
Previous Kimwolf builds used the internal version strings such as n[redacted]boxv4 and n[redacted]boxv5 , establishing the naming pattern for the family.
What to watch next
Watch for additional exploitation reporting, newly published indicators, and changes to vendor guidance.
What remains unknown
The available reporting does not establish who is behind the activity, if an attacker is involved.