Kimwolf v7: The Botnet Behind the Record DDoS Attack Just Learned to Wear a Disguise

On December 19, 2025, a botnet threw 31.4 terabits of traffic a second, 200 million requests a second, at a handful of telecom companies. That is, as far as anyone has measured, the largest DDoS attack ever recorded. The botnet behind it just released a new version. This post starts from zero and walks through what changed.

First: what is a botnet, and what is a DDoS attack?

A botnet is a large number of hijacked devices, routers, cameras, TV boxes, anything with a chip and a network connection, all quietly taking orders from one attacker. Individually each device is nothing. Together, thousands or millions of them can be pointed at one target at once.

A DDoS attack (distributed denial-of-service) is exactly that: pointing the whole botnet at one website or server simultaneously, so it drowns under more traffic than it can handle and goes down for real users.

The botnet in this story is known by two names. AISURU is the name for the Linux and router side of it. Kimwolf is the name for the Android side, the part that has spent the last year specifically going after Android TV boxes. Same operators, same infrastructure, two device families.

How it gets in: the front door was already open

Kimwolf doesn't need a software vulnerability to break in. It needs a setting nobody remembered to turn off.

Many cheap Android TV boxes ship with Android Debug Bridge (ADB) enabled by default. ADB is a legitimate developer tool, meant for plugging your device into a laptop over USB to install and debug apps. Left on and exposed to the network on port 5555, it becomes a door with no lock: anyone who can reach that port can push an app onto the device and run it, no password, no prompt, nothing.

The attackers don't scan the open internet for these one at a time. They rent access through residential proxy services, networks of already-compromised home devices that let a paying customer route traffic through someone else's house. That gets them onto home networks from the inside, where an exposed ADB port on a TV box in the living room is easy to find and nobody's firewall is watching for it.

Once in, they push an APK disguised as SystemService, a name chosen to look like part of Android itself. It checks for root access, then unpacks and runs a bundled Linux payload built for the device's ARM processor. That payload is Kimwolf.

What's new in v7: the disguise

Earlier versions of this botnet were loud. Version 7, found by Palo Alto Networks' Unit 42 in February 2026, is built to be quiet in a specific way.

Its new headline feature is an HTTP/2 flood that fully mimics a real browser. It statically links nghttp2, the same HTTP/2 library real applications use, and builds requests with the header order, protocol behavior, and fingerprint of an actual Chrome browser. To a server on the receiving end, malicious traffic and a real visitor loading a real page look close to identical at the protocol level. That's the difference between a burglar kicking in your door and a burglar walking in wearing your delivery courier's uniform. The door alarm never goes off, because nothing looks wrong until the volume gives it away.

The rest of v7 is a cleanup, not a new idea: the operators cut the DDoS toolkit from 43 loosely named attack methods down to 15 numbered ones, and stripped out the scanning and exploitation code entirely. That's a division of labor. Separate tools now handle breaking in; this binary's only job is attacking and relaying traffic. It also picked up a UDP flood hand-tuned for ARM chips, using NEON SIMD instructions to process multiple data chunks per cycle, squeezing more attack traffic out of the same cheap TV box hardware.

Losing one road home isn't enough anymore

In December 2025, defenders took down domains this botnet relied on to reach its command-and-control servers. Version 7's other major change is a direct answer to that: it no longer depends on one road home.

• First choice: it queries the Ethereum Name Service (ENS) through five legitimate, public Ethereum blockchain RPC endpoints, shuffled randomly before each attempt, to resolve where its control server currently lives. Blockchain lookups are hard to take down, because doing so means blocking infrastructure that legitimate crypto applications also depend on.
• Backup: a hard-coded Tor .onion hidden service address, reached over an encrypted tunnel that's difficult to trace or block wholesale.
• Routing layer: every one of those connections, clearnet or Tor, gets funneled through a local proxy on 127.0.0.1:23075. That means the operators can swap out how it reaches the internet without ever touching or recompiling the main malware.

Take down one path and the malware simply tries the next. This is the same lesson as the Trivy supply-chain post in a different shape: attackers increasingly design for resilience against takedown from the start, not as an afterthought.

Who's behind it

Unit 42 traced the version 7 infrastructure to 22 IP addresses on AS202799, hosted in Saint Petersburg, Russia, all sharing identical SSH host keys between mid-December 2025 and early February 2026, all traced back to a single seed server. That's a strong signal of one operator standing up infrastructure at scale, not a loosely affiliated crowd.

This isn't a new group. AISURU and Kimwolf are the same botnet that hit KrebsOnSecurity with a then-near-record 6.3 Tbps attack in May 2025, then blew past 11 Tbps days later, then 22 Tbps by late September, then 29.6 Tbps in October, before the December 19 attack that made it the largest DDoS ever recorded. Version 7 isn't a new campaign. It's the same operators tuning an already record-holding weapon to be harder to see coming and harder to shut down.

The honest part: there's no CVE to patch here

There's nothing in this story to patch. No vulnerability got disclosed, because none was needed. The entire infection chain runs through a feature working exactly as designed, ADB, left in a state it should never have shipped in.

That's worth sitting with. The scariest part of this story isn't the 200 million requests a second. It's that the entry point, on well over two million devices at last count, is a default setting on a $30 TV box that nobody in the house has ever heard of, let alone configured.

What to actually do about it

• Treat Android TV boxes and cheap IoT devices as untrusted on your network. Segment them, whether at home with a guest network or in an office with real VLANs. They should never sit on the same network segment as anything sensitive.
• Disable ADB, or restrict it to USB-only. This alone removes Kimwolf's primary way in. Most TV box settings menus have an ADB toggle; if yours doesn't obviously have one, that's itself worth treating as a red flag about the device.
• Don't buy the cheapest unbranded Android TV box you can find. These infections concentrate heavily in low-cost, low-support hardware that ships once and never gets a security update again.
• If you run infrastructure that could be a DDoS target, plan for HTTP/2-mimicking floods specifically. Rate limiting and filtering that assume malicious traffic looks obviously different from real browsers need revisiting. This variant was built to defeat exactly that assumption.

The whole post in four lines

• Kimwolf/AISURU is the botnet behind the largest DDoS attack ever recorded, 31.4 Tbps and 200 million requests a second, in December 2025.
• Version 7 adds an HTTP/2 flood that mimics real browser traffic at the protocol level, plus three separate ways to reach its command server so no single takedown stops it.
• It spreads through Android TV boxes that ship with ADB enabled by default, reached over rented residential proxy networks, no vulnerability required.
• Fix it: disable ADB or restrict it to USB, segment IoT devices off any network you actually care about, and assume attack traffic can now look exactly like a real visitor.

The lock was never broken. It was just never turned in the first place.

Sources and further reading

• The Hacker News: Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing. The article this post is based on.
• Unit 42: Kimwolf v7, An Evolution of the Kimwolf Botnet. The full technical writeup, including the infrastructure clustering, ENS/Tor C2 details, and binary analysis behind this post.
• The Hacker News: Kimwolf Android Botnet Infects Over 2 Million Devices via Exposed ADB and Proxy Networks. Earlier coverage of the ADB infection chain and residential proxy abuse.
• KrebsOnSecurity: DDoS Botnet Aisuru Blankets US ISPs in Record DDoS. Background on the botnet's escalating attack record through 2025.