Kimwolf botnet rebuilt to survive takedowns, researchers say
Palo Alto Unit 42 reports the Kimwolf/Aisuru botnet now uses HTTP/2 Chrome-impersonation floods and Ethereum blockchain-based command resolution to survive takedowns.
Palo Alto Networks' Unit 42 says a new Kimwolf/Aisuru botnet version active since February conducts DDoS floods over HTTP/2 with full Chrome browser fingerprints, making attack traffic hard to distinguish from real users. The malware resolves command servers via the Ethereum Name Service using five shuffled Ethereum endpoints, with a Tor hidden service fallback, so authorities cannot seize a domain or serve a takedown order. The botnet, powered mostly by hijacked Android TV boxes and IoT devices, previously had servers seized and an alleged operator arrested; new C2 infrastructure traces to a single network in Saint Petersburg, Russia. It is unclear whether the same developers built the new version.
- New flood method uses HTTP/2 with full Chrome browser fingerprints
- C2 resolved via Ethereum Name Service with five shuffled endpoints and Tor fallback
- Botnet powered mainly by hijacked Android TV boxes and IoT devices
- C2 servers traced to a single network in Saint Petersburg, Russia
- ATT&CK
- T1498 Network Denial of ServiceT1071.001 Application Layer Protocol: Web ProtocolsT1568 Dynamic ResolutionT1090.003 Multi-hop Proxy
- Vendors
- Palo Alto Networks
- Products
- ChromeAndroid TV
- Malware
- Kimwolf
- Organizations
- Unit 42
- Countries
- Russia
From the original article
3 min read at cyberscoop.com
Months after police seized its servers and arrested an alleged operator, the Kimwolf botnet is running code that disguises attacks as Chrome traffic and fetches its orders from the Ethereum blockchain.
By @gregotto · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.