Full Report
Months after police seized its servers and arrested an alleged operator, the Kimwolf botnet is running code that disguises attacks as Chrome traffic and fetches its orders from the Ethereum blockchain. The post Kimwolf botnet rebuilt to survive takedowns, researchers say appeared first on CyberScoop.
Analysis Summary
# Tool/Technique: Kimwolf (aka Aisuru) v7
## Overview
Kimwolf is a sophisticated DDoS botnet that primarily infects Android TV boxes and other IoT devices. Recently rebuilt into version 7 (v7), the botnet has evolved to survive law enforcement takedowns by utilizing blockchain-based command-and-control (C2) infrastructure and advanced stealth techniques to bypass modern web defenses.
## Technical Details
- **Type:** Malware family (Botnet / DDoS-as-a-Service)
- **Platform:** Android (TV boxes), IoT devices
- **Capabilities:** High-volume DDoS, HTTP/2 flood, browser fingerprinting, decentralized C2 resolution
- **First Seen:** Version 7 active since February 2024 (Initial variants tracked back to 2023)
## MITRE ATT&CK Mapping
- **[TA0011 - Command and Control]**
- **[T1568.003 - Dynamic Resolution: DNS over Blockchain]** (Ethereum Name Service)
- **[T1090.003 - Proxy: Multi-hop Proxy]** (Tor hidden services)
- **[TA0043 - Reconnaissance]**
- **[T1592 - Gather Victim Host Information]** (Browser fingerprinting for impersonation)
- **[TA0040 - Impact]**
- **[T1498.001 - Network Denial of Service: Direct Network Flood]** (HTTP/2 flooding)
## Functionality
### Core Capabilities
- **HTTP/2 Flooding:** Uses the modern web protocol to launch high-volume request attacks.
- **Chrome Impersonation:** Emulates full Google Chrome browser fingerprints, including header ordering and behavior, to evade automated DDoS mitigation tools.
- **Botnet Persistence:** Specifically redesigned to maintain operations after infrastructure seizures and arrests of operators.
### Advanced Features
- **Blockchain C2 (ENS):** Resolves command server addresses via the Ethereum Name Service (ENS). This decentralized ledger makes it impossible for law enforcement to seize domains through traditional registrars.
- **Multi-Layered Redundancy:**
- Rotates through five different public Ethereum gateways.
- **Tor Fallback:** If blockchain resolution fails, the malware utilizes a hardcoded Tor (.onion) hidden service address to receive orders, masking the physical location of the C2.
- **Infrastructure:** Analysis indicates the C2 backend is located on a specific network in Saint Petersburg, Russia.
## Indicators of Compromise
- **File Hashes:** [Specific hashes not provided in the article; refer to Unit 42 report for full list]
- **Network Indicators:**
- `ens[.]domains` (Used for legitimate resolution, but queried by malware)
- Ethereum gateway URLs (various)
- Tor Onion Service: [Hardcoded in binary - defanged in reports]
- SSH Host Keys: Shared across four servers in a Saint Petersburg-based network.
- **Behavioral Indicators:**
- High frequency of HTTP/2 requests with Chrome-specific headers from IoT/Android device IP ranges.
- Outbound traffic to Ethereum gateways and Tor entry nodes from non-standard devices (TV boxes).
## Associated Threat Actors
- **Aisuru Group** (Original developers)
- **Kimwolf/Jackskid/Mossad** (Splinter groups/aliases)
- **Geographic Origin:** Infrastructure linked to Saint Petersburg, Russia.
## Detection Methods
- **Behavioral detection:** Monitoring for unexpected Tor or Ethereum gateway traffic originating from IoT/Android TV devices.
- **Network Analysis:** Identifying HTTP/2 traffic that perfectly mimics Chrome fingerprints but originates from non-desktop/non-mobile device signatures.
- **Infrastructure Tracking:** Monitoring for the specific SSH host keys associated with the Saint Petersburg-based C2 cluster.
## Mitigation Strategies
- **Network Segmentation:** Isolate IoT devices and Android TV boxes on a separate VLAN to prevent lateral movement and monitor outbound traffic.
- **Egress Filtering:** Block or alert on traffic to known Tor entry nodes and public Ethereum API gateways from IoT segments.
- **DDoS Protection:** Employ advanced Web Application Firewalls (WAFs) capable of analyzing behavioral inconsistencies in HTTP/2 headers, even when they mimic valid browsers.
- **Firmware Updates:** Ensure Android-based devices are updated to the latest security patches to prevent initial infection.
## Related Tools/Techniques
- **Aisuru:** The parent botnet from which Kimwolf splintered.
- **Mirai:** Though different in architecture, shares the target demographic of IoT devices.
- **DNS over Blockchain:** A technique increasingly used by malware (like NjRAT or various info-stealers) to avoid domain takedowns.