The Big, Bad Kimwolf

How many devices do you have connected to your workplace internet? Aside from the computers your coworkers use or the personal devices they bring to the office daily, how many everyday items like a camera or thermostat are around your workplace that, for whatever reason, have been given the ability to connect to Wi-Fi? For better or worse, we are living in an Internet of Things world, where we are always finding mundane technology to spruce up with an internet connection. Our refrigerators are just so much better if they can also tell us the weather outside, right?

Living in an IoT world comes with a plethora of security risks, but one threat in particular thrives in this environment: the botnet. The term “botnet” simply refers to a collection of computers that coordinate to perform a specific task, though the word is most commonly used to describe botnets consisting of a large quantity of hijacked devices repurposed to perform distributed denial-of-service (DDoS) attacks. One botnet, Kimwolf, is becoming something of a poster child for these kinds of threats.

Kimwolf’s Origins

Kimwolf is a botnet that has been on researchers’ radar since October 2025 and has proven itself to be especially unique and concerning. Beyond simple DDoS attacks, Brian Krebs, a researcher who has done extensive research on Kimwolf, points out that “the Kimwolf malware forces compromised systems to relay malicious and abusive Internet traffic - such as ad fraud, account takeover attempts and mass content scraping.”

Evidence suggests that Kimwolf was actually derived from an already notorious botnet called AISURU, which reportedly launched a record-breaking 29.7 terabits per second (Tbps) DDoS attack last year. It appears that the two “botmasters” behind Kimwolf, only identified by their online handles “Dort” and “Snow”, were also heavily involved in the AISURU botnet.

Researchers even speculate that before Kimwolf was discovered, some of its attacks were misattributed to AISURU due to their similarities. Kimwolf, however, has improved upon its predecessor’s foundation by taking advantage of vulnerabilities in “residential proxies” to spread at alarming speeds.

The Kimwolf Epidemic

Shortly after researchers discovered Kimwolf in October, one of Kimwolf’s C2 domains - 14emeliaterracewestroxburyma02132[.]su - exploded with activity, causing it to temporarily be ranked first in Cloudflare’s list of top 100 domains, putting it ahead of even Google. By early January, the results of this activity were clear: Kimwolf had infected over 2 million devices and had issued over 1.7 billion DDoS attack commands.

This rapid growth over the course of just a few months was facilitated by insufficient security practices from residential proxy services. A residential proxy, like other proxy servers, acts as an intermediary between your device and the internet, but with the added benefit of appearing more legitimate by using an IP address provided by an internet service provider, making it associated with a real residential address. Unfortunately, providers of residential proxies rarely do enough to prevent hackers from breaking through proxy endpoints into the local networks they’re a part of. The hackers behind Kimwolf found they could bypass the basic steps proxy services take to prevent customers from entering a local network simply by changing their DNS settings to match the address ranges in RFC-1918. Kimwolf mainly targets proxies provided by the Chinese service IPIDEA, which has millions of proxy endpoints for any given week.

This might not seem like that big a deal: if you’ve never set up a residential proxy network, you’re safe, right? But malware is often responsible for turning a device into a residential proxy without the consumer’s consent, so these residential proxies could be on your network without you knowing. Such malware is distributed via sketchy apps and games sometimes, but the vast majority of devices making up the Kimwolf botnet, around two-thirds, come with residential proxy malware pre-installed: unofficial Android TV boxes. These off-brand TV boxes are sold by third-party merchants on popular online shopping platforms like Amazon, Walmart, or BestBuy. If you have any of the TV box models listed here, then your network could have been infected with Kimwolf.

The off-brand TV boxes also have an additional vulnerability Kimwolf takes advantage of: essentially all these devices are shipped from the factory with a feature called Android Debug Bridge (ADB) mode enabled. This feature causes the devices to, as Krebs puts it, “constantly listen for and accept unauthenticated connection requests,” which allows for attackers to gain unrestricted administrative access to the TV box.

Between insufficient security practices from residential proxy services, malware turning devices into residential proxies, and the particular ADB vulnerability in off-brand Android TV-boxes, Kimwolf found the perfect environment to propagate rapidly and become a major problem in only a few months.

Kimwolf’s Impact

As previously mentioned, Kimwolf has been found in over 2 million devices, but even more concerning is that Kimwolf is surprisingly prevalent in government and corporate networks. Krebs reports that Synthinet, a startup founded by Benjamin Brundage who first started tracking Kimwolf, “spied at least 33,000 affected Internet addresses at universities and colleges, and nearly 8,000 IPIDEA proxies within various U.S. and foreign government networks.” While these places might not have residential proxies on their network, Kimwolf’s unique way of spreading means that anyone carrying a device that has been turned into a residential proxy could connect to a Wi-Fi network and expose any unsecured devices to Kimwolf infection.

Another concerning Kimwolf development came in late January when evidence emerged that Dort had obtained access to the control panel for Badbox 2.0, described by Krebs as “a vast China-based botnet powered by malicious software that comes pre-installed on many Android TV streaming boxes.” This means that in spite of efforts to fight Kimwolf, Dort could leverage his access to this secondary botnet to keep Kimwolf alive alongside Badbox 2.0 in any infected device.

Proxy providers have attempted to patch their systems, but their success in doing so has been mixed at best. Kimwolf persists on millions of devices thanks to its highly resilient and contagious nature. However, there is some good news.

The pushback against Kimwolf has definitely ruffled Dort’s feathers. They have been incredibly hostile towards Krebs and Brundage, who have been largely responsible for getting the word of Kimwolf out so proxies could start fighting back. Dort has doxxed Brundage and even directed a “swatting” attack at him, meaning he called in a false tip to the police to get them to show up at Brundage’s house. These actions signal a certain level of immaturity and inexperience that is even more prevalent in a recent incident involving the Invisible Internet Project (I2P).

Kimwolf recently disrupted the decentralized, encrypted communications network I2P when Kimwolf’s controllers attempted to join 700,000 Kimwolf-infected bots as nodes to the network, which far exceeds the I2P’s normal size of roughly between 15,000 and 20,000 devices.

However, this disruption didn’t appear to be malicious in nature. Instead, Kimwolf operators appeared to have been trying to build a C2 network that is harder to take down by security companies. Evidently, all the takedown attempts, while not wholly effective, are still getting under Dort’s skin.

Krebs also mentions that “Kimwolf’s overlords appear to have quite recently alienated some of their more competent developers and operators, leading to a rookie mistake […] that caused the botnet’s overall numbers to drop by more than 600,000 infected systems.” Before security companies figure out a way to take down Kimwolf, poor management might just do the job for them.

Fighting Kimwolf

If you have an off-brand TV box, especially one that matches one of the model names listed here, get rid of it. It could very well be a residential proxy infecting devices in your home, or even your company, with the Kimwolf botnet. A piece of advice that Krebs gives is to set up your wireless routers to allow guests access to the internet without being able to talk to other devices on your local network. That way, if someone connects a Kimwolf-infected device to your internet, that device won’t be able to infect other vulnerable devices on your network.

If you’re concerned that your company was infected with the Kimwolf botnet, Crimson Vista provides several investigative services to diagnose your network, as well as experts who can help you strengthen your company’s security posture and employ better practices. Above all, remember that each new connection to your network is a potential point of attack for cybercriminals.

Kimwolf’s Origins

The Kimwolf Epidemic

Kimwolf’s Impact

Fighting Kimwolf

Sources

Keep reading.

A Flocked Up World: Part 1

Psychology-Aware Security Design

AI: The New Face of Cybersecurity