Kimwolf v7 Android Botnet Uses HTTP/2 to Evade DDoS Detection

Cybersecurity researchers have uncovered a new version of the Kimwolf/AISURU Android and IoT botnet, tracked as Kimwolf v7, which introduces significant enhancements to improve operational resilience and conduct distributed denial-of-service (DDoS) attacks. Discovered by Palo Alto Networks Unit 42 in February 2026, this version adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints, making attack traffic nearly indistinguishable from legitimate browsing.

The botnet also strengthens its command-and-control (C2) infrastructure against takedowns by using a tiered mechanism that leverages Ethereum Name Service (ENS) to resolve C2 addresses, a hard-coded Tor .onion hidden service, and a local proxy for routing between clearnet and Tor. Notably, Kimwolf v7 removes all scanning, exploitation, and brute-force functionality, indicating that the operators have split the propagation pipeline from the core payload, offloading initial access to an external loader while the Kimwolf binary focuses on DDoS attacks and proxy relay.

Kimwolf has been active since at least mid-2024, primarily targeting Android TV boxes and Linux IoT devices. The botnet abuses residential proxy services to reach Android TVs with ADB enabled on port 5555, installing malware that disguises itself as legitimate system processes. New features include HTTP/2 flood attacks using the nghttp2 library, use of public Ethereum RPC services for ENS resolution, a backup Tor C2 mechanism, a local proxy architecture routing through 127.0.0.1:23075, a high-performance UDP flood function for ARM processors, and consolidation of DDoS commands to 15 numbered methods.

Unit 42 identified eight Android APK artifacts masquerading as SystemService between October and December 2025, with the earliest sample targeting x86 architecture via a Dirty COW exploit. The disclosure also highlights other emerging botnet families, including AryStinger, RustDuck, NadMesh, and Tengu. Unit 42 recommends treating Android TV boxes as untrusted, segmenting them from enterprise networks, and disabling ADB or restricting it to USB-only access to mitigate the primary propagation vector.