Kimwolf v7 Hides DDoS Traffic Behind Chrome Fingerprints and Ethereum
Unit 42 details Kimwolf v7, an Android TV botnet upgrade using HTTP/2 Chrome-fingerprint DDoS floods and Ethereum ENS-based C2 across 1.8M+ infected devices.
Palo Alto Networks Unit 42 identified Kimwolf v7 on February 3, 2026, an upgrade to an Android TV botnet active since August 2025 and linked to the AISURU botnet, which has infected over 1.8 million devices. The new version adds an HTTP/2-based DDoS flood that mimics full Chrome browser fingerprints, consolidates 43 attack commands into 15 methods covering layers 3-7, and resolves C2 addresses via Ethereum Name Service using five hard-coded public blockchain RPC endpoints, backed by a Tor hidden service and a local proxy on 127.0.0.1:23075. It spreads through residential proxies to Android TV boxes with ADB enabled on port 5555 and masquerades as netd_service. The botnet is associated with the record 31.4 Tbps DDoS attack in November 2025.
- HTTP/2 flood mirrors legitimate Chrome behavior at protocol and header level, complicating mitigation.
- Three-tier C2: Ethereum ENS via five public RPC endpoints, Tor .onion backup, local proxy on port 23075.
- Spreads via residential proxies to Android TV boxes with ADB enabled on port 5555; masquerades as netd_service.
- Propagation separated from DDoS core; external loaders handle initial access.
- Linked to AISURU and the record 31.4 Tbps DDoS attack in November 2025.
- ATT&CK
- T1210 Exploitation of Remote ServicesT1090.003 Multi-hop ProxyT1036.005 Match Legitimate Name or LocationT1499.002 Application Exhaustion Flood
- Vendors
- Palo Alto Networks
- Products
- Android TV
- Organizations
- Unit 42CloudflareXLab
- Countries
- Russia
From the original article
5 min read at securityaffairs.com
Kimwolf v7: The Android TV Botnet That Now Hides Its Traffic Behind Chrome Fingerprints and Ethereum Palo Alto Networks Unit 42 discovered Kimwolf v7 on February 3, 2026, while hunting threats following public disclosures of the botnet’s earlier activity.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.