Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
New Kimwolf v7 Android botnet adds HTTP/2 DDoS floods with Chrome fingerprints and takedown-resistant ENS/Tor C2.
Palo Alto Networks Unit 42 discovered Kimwolf v7, an evolution of the Kimwolf/AISURU Android and IoT botnet first tracked in February 2026. The new version performs HTTP/2 floods mimicking Chrome browser fingerprints and uses Ethereum Name Service, Tor hidden services, and a local proxy for resilient C2. The botnet targets Android TV boxes via ADB on port 5555 and offloads propagation to an external loader.
- HTTP/2 flood builds complete Chrome browser fingerprints
- C2 resolution via Ethereum Name Service and hard-coded Tor onion
- Propagation split off to external loader; binary handles DDoS and relay
- Targets Android TV boxes with ADB exposed on port 5555
- DDoS command set consolidated to 15 numbered methods
- CVEs
- CVE-2024-36401
- ATT&CK
- T1498.002 Reflection AmplificationT1098 Account ManipulationT1036.004 Masquerading: Masquerade Task or ServiceT1572 Protocol TunnelingT1595.002 Vulnerability Scanning
- Vendors
- Palo Alto Networks Unit 42
- Products
- Kimwolf v7AISURU
- Threat actors
- Kimwolf
- Organizations
- Palo Alto Networks Unit 42
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-36401 | Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection | 9.8 | 100% | KEVPoC ×3 | KEV |
From the original article
3 min read at thehackernews.com
Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service (DDoS) attacks. The new version, tracked as Kimwolf v7, was discovered by Palo Alto Networks Unit 42 in February 2026.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.