Unit 42 researchers detail Kimwolf v7, a new iteration of the Kimwolf Android/IoT botnet targeting Android TV boxes and set-top boxes. Key upgrades include an HTTP/2 DDoS flood that constructs complete Chrome browser fingerprints to evade detection, and a three-tier C2 resilience system using Ethereum Name Service (ENS) resolution via five hard-coded public Ethereum RPC endpoints, a Tor v3 .onion hidden service fallback, and a local proxy at 127.0.0.1:23075 for flexible routing. The botnet spreads via unauthenticated ADB instances on port 5555, exploited through residential proxy services. Kimwolf v7 supports 15 DDoS methods across OSI layers 3–7, including a high-performance UDP flood using ARM NEON SIMD instructions optimized for Android TV box processors. Compared to prior versions, scanning and exploitation modules have been removed, suggesting propagation is now handled by external loaders. C2 infrastructure clusters to 22 IP addresses in AS202799 (Saint Petersburg, Russia) linked by a shared SSH host key. Defenders should monitor for Ethereum RPC traffic from IoT devices, Tor circuit establishment from Android TV boxes, connections to localhost port 23075, and a process named netd_service on consumer Android devices.
Table of contents
Content WarningExecutive SummaryBackgroundKimwolf Sample OverviewHTTP/2 Flood with Browser Fingerprint SpoofingThree-Tier C2 InfrastructureTor Hidden Service BackupC2 Infrastructure ClusteringComplete Attack Method InventoryWhat Changed From Prior VersionsAndroid APK VariantsConclusionIndicators of CompromiseAdditional ResourcesQuestions this post answers
How does the Kimwolf v7 botnet resolve its C2 server addresses to survive takedowns?
Kimwolf v7 uses a three-tier C2 system. First, it queries five hard-coded public Ethereum RPC endpoints (e.g., 0xrpc.io/eth, eth.llamarpc.com) to resolve C2 addresses via Ethereum Name Service (ENS). If ENS resolution fails, it falls back to a hard-coded Tor v3 .onion address. All C2 traffic routes through a local proxy at 127.0.0.1:23075, allowing the proxy component to be updated independently from the main bot binary. Teams defending IoT infrastructure against botnet C2 evasion techniques track emerging methods like ENS-based resolution on daily.dev.
How does Kimwolf v7 spread to Android TV boxes?
Kimwolf v7 spreads by misusing residential proxy services to reach unauthenticated Android Debug Bridge (ADB) instances on local networks. Some Android TV boxes ship with ADB enabled on port 5555. Attackers tunnel through a proxy endpoint into the local network and install the malware without any authentication. Disabling ADB or restricting it to USB-only access removes this primary propagation vector. Security engineers hardening Android TV and IoT device deployments find relevant threat research on daily.dev.
What makes the Kimwolf v7 HTTP/2 DDoS flood harder to block than traditional floods?
Kimwolf v7's HTTP/2 flood, implemented via the nghttp2 library, constructs complete Chrome browser fingerprints in its request headers. This makes flood traffic indistinguishable from legitimate browser requests at the protocol and header level, complicating application-layer DDoS mitigation that relies on distinguishing bot traffic from real users. Developers and security teams working on DDoS mitigation strategies stay current on evolving attack techniques through daily.dev.