Actor Profile

Kimwolf (also tracked as AISURU) is an Android and IoT botnet operation active since at least mid-2024. The threat actors behind Kimwolf have demonstrated continuous evolution in their tooling, targeting Android TV boxes since August 2025 and Linux IoT devices through the AISURU variant. The operators show sophisticated operational security practices, including splitting their propagation pipeline from core payload delivery, using external loaders for initial access while the Kimwolf binary focuses exclusively on DDoS attacks and proxy relay functionality. Their motivation centers on building a large-scale botnet infrastructure for conducting DDoS-for-hire services and operating residential proxy networks.

TTPs (Tactics, Techniques, Procedures)

Kimwolf v7 employs multiple MITRE ATT&CK techniques: Initial Access via exploitation of Android Debug Bridge (ADB) enabled on port 5555 (T1190: Exploit Public-Facing Application); Defense Evasion through process masquerading as legitimate Android system processes like "netd_service" (T1036: Masquerading); Command and Control using tiered infrastructure including Ethereum Name Service (ENS) for C2 resolution, hard-coded Tor .onion hidden services, and local proxy architecture routing traffic through 127.0.0.1:23075 (T1090: Proxy, T1573: Encrypted Channel); Impact through HTTP/2-based DDoS floods with complete browser fingerprinting using nghttp2 library, high-performance UDP floods targeting ARM processors, and 15 consolidated DDoS attack methods (T1498: Network Denial of Service, T1499: Endpoint Denial of Service); Persistence via APK packages masquerading as SystemService that probe for root access and execute bundled ELF kernel payloads, including historical use of Dirty COW exploits (T1068: Exploitation for Privilege Escalation, T1543: Create or Modify System Process).

Targets & Patterns

Kimwolf primarily targets Android TV boxes and Linux IoT devices with poor security configurations. The Android variant specifically exploits devices shipping with Android Debug Bridge (ADB) enabled on port 5555 on local networks, a common misconfiguration in consumer Android TV hardware. The Linux counterpart (AISURU) focuses on vulnerable Linux IoT devices. The threat actors abuse residential proxy services to reach these devices, suggesting they target home networks and small office environments where security controls are minimal. The botnet's focus on ARM processors in Android TV boxes and the removal of scanning/exploitation modules indicates a shift toward targeted propagation via external loaders rather than opportunistic mass scanning. Organizations with Android TV boxes in enterprise environments represent secondary targets where network segmentation is inadequate.

Historical Context

Kimwolf has been active since at least mid-2024, with Android TV targeting observed since August 2025. Version 7, discovered by Unit 42 in February 2026, represents a significant architectural evolution. Earlier variants included 43 text-named DDoS methods, integrated scanning and exploitation modules, and simpler C2 infrastructure. The earliest dropped samples targeted x86 architecture using the Dirty COW exploit, indicating the botnet family evolved from traditional Linux exploitation toward the current ADB-based Android propagation model. Operational security adjustments are evident in filename changes observed between October and December 2025, including transitions from libn[redacted]kernel.so to libdevice.so and subsequent reverts. The v7 release marks a strategic shift toward operational resilience through tiered C2 infrastructure (ENS, Tor), separation of propagation from payload delivery, and enhanced attack sophistication via HTTP/2 floods with browser fingerprinting that make malicious traffic harder to distinguish from legitimate browsing.

Defensive Recommendations

  • Segment Android TV boxes and IoT devices from enterprise networks using VLANs or separate network zones; treat these devices as untrusted endpoints
  • Disable Android Debug Bridge (ADB) on Android TV devices or restrict it to USB-only access to eliminate the primary propagation vector (port 5555)
  • Monitor for suspicious process names mimicking legitimate Android system services (e.g., 'netd_service') and unexpected ELF binary execution on Android devices
  • Block or monitor DNS-over-HTTPS queries to Ethereum RPC services and Tor traffic (particularly connections to .onion domains) from IoT device segments to detect C2 communication attempts (T1090, T1573)
  • Deploy network behavioral analysis to identify HTTP/2 traffic patterns inconsistent with expected device behavior, including unusual volumes of HTTP/2 requests from IoT devices and Android TV boxes (T1498, T1499)
  • Implement egress filtering to prevent IoT devices from establishing outbound connections on non-standard ports, particularly monitoring for local proxy activity on unusual ports like 23075