Kimwolf v7 Removes Exploitation Code and Leaves Infection to External Loaders

A newly identified Kimwolf v7 build shows the Android and IoT botnet shifting from an all-in-one compromise toolkit into a more specialized DDoS and proxy-relay payload.

The latest variant removes embedded scanning, exploitation and brute-force logic, suggesting its operators now depend on external loaders to obtain access to vulnerable devices before deploying the bot.

Unit 42’s analysis positions the change as a deliberate operational split rather than a reduction in capability.

Kimwolf, also tracked in relation to the AISURU ecosystem, primarily targets Android TV boxes and set-top boxes. Earlier variants spread by abusing residential proxy services to reach Android Debug Bridge instances exposed on port 5555 inside local networks.

Once traffic was tunneled through a proxy endpoint, attackers could install the payload on devices with unauthenticated ADB enabled.

The v7 redesign indicates that this initial-access work has been externalized, while the deployed binary concentrates on sustaining command-and-control connectivity and launching high-volume attacks.

The most consequential addition is an HTTP/2 flood implemented with the nghttp2 library. Instead of issuing simplistic web requests, Kimwolf v7 constructs detailed Chrome-like browser fingerprints, including protocol behavior and request-header patterns that more closely resemble legitimate browsing.

This raises the difficulty of distinguishing malicious Layer 7 traffic from real user sessions through conventional signature, header-order or rate-based controls.

The malware retains 15 numbered DDoS methods spanning TCP, UDP, DNS, ICMP, TLS/HTTPS and HTTP/2 floods.

Unit 42 Researchers said that, Kimwolf v7 also delivers a performance-focused UDP flooding routine tailored to ARM hardware common in Android TV devices.

The code uses a Xorshift256 pseudo-random number generator seeded from /dev/urandom, with fallback initialization when that source is unavailable.

It further accelerates checksum calculations through ARM NEON SIMD instructions, reducing per-packet processing overhead and enabling infected consumer devices to contribute more efficiently to volumetric attacks.

The file was compiled with the Android Native Development Kit (NDK) using Clang and uses Bionic libc. It statically links BoringSSL for Transport Layer Security (TLS) operations and nghttp2 for HTTP/2 functionality.

C2 resilience is the second major theme of the update. The binary hard-codes five public Ethereum RPC services and queries Ethereum Name Service records to resolve current C2 addresses.

Because the endpoints are legitimate public infrastructure and are shuffled before resolution attempts, defenders cannot simply block one domain or IP address without creating limited results and possible operational impact.

Kimwolf v7 Removes Exploitation

Unit 42 also identified eth[.]rpcuniverse[.]com as a suspected operator-controlled RPC facade, based on its infrastructure characteristics and its presence exclusively in Kimwolf samples.

If ENS-based resolution fails, Kimwolf v7 falls back to a hard-coded Tor v3 hidden service. All C2 traffic is routed through a local proxy listening on 127.0.0[.]1:23075, whether the final destination is a clearnet host or Tor.

This modular architecture enables operators to modify proxy behavior independently from the primary bot binary and appears designed to withstand the C2 takedowns that disrupted the operation in December 2025.

The sample masquerades as netd_service, a name intended to blend with legitimate Android networking processes.

Researchers clustered related infrastructure around 22 IP addresses in AS202799, geolocated to Saint Petersburg, Russia, after identifying a shared SSH host key across hosts observed between December 2025 and February 2026.

That clustering provides defenders with a stronger pivot point than individual destination IPs alone.

For defenders, the practical detection focus should shift from exploit signatures to behavioral telemetry.

Unexpected outbound Ethereum RPC requests from Android or IoT devices, Tor or SOCKS activity from TV boxes, localhost connections to port 23075, and suspicious netd_service processes are higher-value indicators.

Organizations should also restrict ADB exposure, segment unmanaged Android devices, and apply DNS Security, Advanced URL Filtering, and IoT visibility controls.

Kimwolf v7 demonstrates that modern botnet operators increasingly separate access, payload delivery, attack execution and resilient C2 into independently adaptable components.

IOCs

Field	Value
Malware family / payload	Kimwolf v7 bot payload
Analysis role	Baseline analyzed sample
SHA-256	406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ff
MD5	d759364844d78a728505fb0485c3adbc
File size	1,720,108 bytes
File type	ELF 32-bit LSB executable
Architecture	ARM
Linking	Statically linked
Symbol status	Stripped
Embedded version string	n[redacted]boxv7

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now