Kimwolf v7 Botnet Masks HTTP/2 DDoS Traffic as Legitimate Browsing

Palo Alto Networks Unit 42 researchers Asher Davila, Chris Navarrete, and Doel Santos have uncovered Kimwolf v7, a significantly re-engineered iteration of the Kimwolf/AISURU Android and IoT botnet first observed in mid-2024. Discovered in February 2026, the new variant focuses exclusively on distributed denial-of-service attacks and proxy relay operations, with its operators having offloaded scanning, exploitation, and brute-force capabilities to a separate external loader. The malware primarily targets Android TV boxes shipping with Android Debug Bridge (ADB) enabled on port 5555, exploiting residential proxy services to reach devices on local networks. Defenders are advised to run a port scanner to confirm ADB is not exposed on LAN-facing interfaces.

The most notable advancement in Kimwolf v7 is its HTTP/2-based DDoS flood, built on the nghttp2 library, which constructs complete Google Chrome browser fingerprints at both the protocol and header level. This technique makes attack traffic nearly indistinguishable from legitimate browsing sessions, complicating detection and mitigation efforts. The botnet has also consolidated its DDoS attack commands from 43 text-named methods down to 15 numbered methods, streamlining its command interface. The malware masks itself as a legitimate Android system process called "netd_service" to evade detection, while newly observed Android APK packages masquerade as a system service named SystemService, probe for root access, and execute a bundled ELF kernel. Given the botnet's reliance on impersonating browser behavior, security teams can leverage a browser fingerprint test to better understand how their own clients are identified and potentially spoofed by attackers.

Kimwolf v7's command-and-control infrastructure has been fortified with a tiered resilience mechanism. The malware queries Ethereum Name Service (ENS) domain records via legitimate public Ethereum RPC services to dynamically resolve C2 addresses, ensuring takedown efforts remain short-lived. A hard-coded Tor .onion hidden service ("edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd[.]onion") serves as a backup channel, and all C2 communications are routed through a local proxy at 127.0.0.1:23075, regardless of whether the destination is on the clearnet or Tor. The variant also includes a high-performance UDP flood function optimized for ARM processors found in Android TV hardware. Since Kimwolf operators heavily abuse residential proxy infrastructure to conceal their traffic, operators and SOC teams can use a VPN/proxy detector to identify suspicious relay nodes in their network telemetry.