Full Report
Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service (DDoS) attacks. The new version, tracked as Kimwolf v7, was discovered by Palo Alto Networks Unit 42 in February 2026. "Kimwolf v7 adds an HTTP/2-based
Analysis Summary
# Tool/Technique: Kimwolf v7 (AISURU)
## Overview
Kimwolf (and its Linux counterpart AISURU) is a sophisticated botnet targeting Android TV boxes and IoT devices. The primary purpose of the v7 variant is to conduct high-performance Distributed Denial-of-Service (DDoS) attacks while maintaining operational resilience through decentralized Command and Control (C2) infrastructure. It is notable for its use of HTTP/2 to mimic legitimate human browsing behavior.
## Technical Details
- **Type:** Malware family (Botnet)
- **Platform:** Android (specifically Android TV boxes), Linux (IoT devices), ARM and x86 architectures.
- **Capabilities:** HTTP/2 DDoS flooding, UDP flooding, residential proxy relay, C2 obfuscation via ENS and Tor.
- **First Seen:** Mid-2024 (v7 discovered February 2026).
## MITRE ATT&CK Mapping
- **[TA0011 - Command and Control]**
- [T1568.003 - Dynamic Resolution: DNS Name Service] (Ethereum Name Service)
- [T1573.002 - Encrypted Channel: Asymmetric Cryptography] (Tor .onion services)
- [T1090 - Proxy] (Internal proxy routing and residential proxy abuse)
- **[TA0040 - Impact]**
- [T1498.001 - Network Denial of Service: Direct Network Flood] (UDP/HTTP flood)
- **[TA0005 - Defense Evasion]**
- [T1036.004 - Masquerading: Masquerade Task or Service] (Naming as "netd_service")
- [T1622 - Debugger Evasion] (Abuse of ADB settings)
## Functionality
### Core Capabilities
- **DDoS Engine:** Consolidates 15 numbered attack methods, including a high-performance UDP flood optimized for ARM processors.
- **Protocol Mimicry:** Utilizes the `nghttp2` library to perform HTTP/2 flood attacks.
- **ADB Propagation:** Exploits devices with Android Debug Bridge (ADB) enabled on port 5555 via residential proxies.
- **Proxy Relay:** Acts as a relay to ferry malicious traffic, obfuscating the origin of other attacks.
### Advanced Features
- **Browser Fingerprinting:** Constructs complete browser fingerprints (headers and protocol levels) to make DDoS traffic indistinguishable from legitimate user activity.
- **Resilient C2 Architecture:**
- Queries **Ethereum Name Service (ENS)** via public RPC services to resolve C2 addresses.
- Employs a **Tor .onion hidden service** as a hard-coded backup.
- Uses a **Local Proxy Architecture** (routing through `127.0.0[.]1:23075`) to unify clearnet and Tor traffic.
- **Decoupled Pipeline:** Removed internal scanning/exploit modules, suggesting the use of external loaders for initial access to improve stealth.
## Indicators of Compromise
- **File Names:** `netd_service`, `SystemService` (APK), `libdevice.so`, `libn[redacted]kernel.so`
- **Network Indicators:**
- `edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion`
- `127.0.0[.]1:23075` (Local loopback proxy)
- Port `5555` (ADB)
- **Behavioral Indicators:** Unexpected elevation to root access; high outbound UDP/HTTP/2 traffic; presence of the `nghttp2` library in non-browser system processes.
## Associated Threat Actors
- **Kimwolf/AISURU Operators:** Specifically known for targeting Android-based media devices and IoT hardware.
## Detection Methods
- **Signature-based:** Detection of APKs masquerading as "SystemService" or ELF binaries containing the `nghttp2` library and specific ARM-optimized UDP flood code.
- **Behavioral:** Monitoring for unauthorized ADB connections from residential proxy IP ranges. Identifying unusually high volumes of HTTP/2 traffic with perfect browser fingerprints originating from non-interactive IoT devices.
- **Network:** Monitoring for Ethereum RPC queries specifically looking for ENS domain resolutions linked to known botnet patterns.
## Mitigation Strategies
- **Disable ADB:** Ensure Android Debug Bridge is disabled on production devices, or at least restricted to authorized IP addresses.
- **Network Segmentation:** Isolate IoT and Android TV devices from critical segments of the network.
- **Patch Management:** Apply updates to address legacy vulnerabilities like "Dirty COW" which were used in earlier Kimwolf iterations.
- **Default Credentials:** Change all default credentials on IoT devices to prevent automated lateral movement.
## Related Tools/Techniques
- **AryStinger:** IoT malware for reconnaissance and proxying.
- **RustDuck:** Rust-based botnet targeting routers and Android boxes.
- **NadMesh:** Autonomous scanning and AI-service harvesting botnet.
- **Dirty COW (CVE-2016-5195):** Exploitation technique used by earlier versions for privilege escalation.