Do Son 
At a glance
- Malware family: Kimwolf (also tracked as AISURU)
- Threat actor: Unknown (Operators manage both Linux IoT and Android variants)
- Target or victims: Android TV boxes and set-top boxes
- Delivery vector: Unauthenticated Android Debug Bridge (ADB) via residential proxies
- Key capabilities: HTTP/2 DDoS flooding, browser fingerprint spoofing, ENS resolution, Tor backup
- Source: Palo Alto Networks
TL;DR
Palo Alto Networks identified a new version of the Kimwolf botnet malware. This version severely upgrades its distributed denial-of-service attack features. The malware now uses advanced routing to survive server takedowns.
Delivery
Threat actors deploy this malware primarily against consumer devices. “Kimwolf primarily affects Android TV boxes and set-top boxes.” Specifically, attackers scan for residential devices exposed to the internet. They target set-top boxes shipped with ADB enabled on port 5555.
“Kimwolf spreads by misusing residential proxy services to reach unauthenticated Android Debug Bridge (ADB) instances on local networks.” Once inside the local network, operators install the payload without needing any login credentials. Historically, this malware targeted Linux IoT devices before shifting to Android.
Infection chain
After gaining initial access, the malware drops a statically linked ARM ELF binary onto the system. The binary masks its process name immediately. It uses names like “netd_service” or “TVHelper” to blend in with legitimate system processes. Some variations even disguise themselves as “inetd” to mimic Unix network services.
The malware developers compiled the binary using the Android Native Development Kit. Furthermore, the program creates a unique Unix domain socket to ensure only one instance runs. The malware contains a dedicated UDP flood function optimized for ARM processors. Attackers use NEON single instruction, multiple data (SIMD) instructions to accelerate checksum computations. This optimization significantly boosts attack traffic output.
Additionally, the malware developers consolidated their attack methods. The latest version supports 15 specific denial-of-service techniques. “Kimwolf v7 adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints.” Therefore, this attack traffic looks exactly like normal web browsing.
Command-and-control and data-exfiltration behaviour
The botnet utilizes a complex three-tier communication system. Initially, it relies on Ethereum Name Service (ENS) resolution. The binary stores five hardcoded public Ethereum remote procedure call endpoints. It queries these endpoints to locate its active control servers.
If the public endpoints fail, the malware falls back to a hidden Tor service. The binary carries a hardcoded version 3 Tor .onion address. The developers added this Tor backup to counter a major disruption event. The US Justice Department previously seized portions of the infrastructure in March 2026. This seizure disrupted multiple botnets under the operators’ control.
Moreover, the malware forces all communication through a local proxy running on port 23075. This local proxy routes traffic directly between the standard internet and the Tor network. Security analysts traced the control servers back to 22 IP addresses. All of these addresses operate within a single network provider in Saint Petersburg, Russia. For more technical details on these server configurations, review the Kimwolf botnet malware analysis published by Palo Alto Networks.
Defense or detection guidance
Organizations must secure their connected devices immediately. Administrators should segment Android TV boxes away from critical enterprise networks. Disable the ADB service entirely if it is not required.
Security teams should monitor networks for unusual outbound HTTPS connections. Watch for unexpected Ethereum RPC traffic from standard consumer devices. Look for Tor circuit establishments originating from television hardware. Finally, search for active processes named “netd_service” or “TVHelper” running from unexpected file paths.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
