Unit 42 researchers Asher Davila, Chris Navarrete and Doel Santos identified Kimwolf v7 in February 2026. Kimwolf has been running since mid-2024 on Android and IoT devices; its Linux counterpart is tracked as AISURU.

The v7 change that matters is how the attack traffic looks.

Floods that pass as browsing

Kimwolf uses the nghttp2 library to run HTTP/2 flood attacks, and constructs complete browser fingerprints — mirroring legitimate browser behaviour at the protocol and header level.

That is a direct attack on how volumetric DDoS is filtered. Mitigation at the application layer works by finding the ways automated traffic differs from a browser: header order, HTTP/2 settings frames, window sizes, the shape of the connection. Get all of those right and the request is, to a filter, a person visiting the site.

The defence that remains is behavioural and volumetric rather than signature-based — rate, distribution, and what the traffic asks for. Those are slower and noisier than fingerprint matching, which is exactly the trade the malware is trying to force.

The devices are Android TV boxes with a debug port open

Infection comes through exposed Android Debug Bridge ports (5555) on local networks. The botnet then distributes APK packages posing as "SystemService", which probe for root and execute embedded ELF payloads.

ADB on 5555 is a developer feature. It ships enabled on a long tail of cheap Android TV boxes, and the people who own those boxes are not reading advisories.

That is the same structural problem behind the SIM interface that lets a card run commands on a modem and behind the water systems reached through cellular modems with no exploit at all: the vulnerable population is devices nobody administers, with a service enabled by default, on a network nobody segments.

v7's infrastructure

  • Ethereum Name Service (ENS) for command-and-control resolution
  • A hard-coded Tor .onion address
  • Traffic routed through a localhost proxy at 127.0.0.1:23075

ENS is the notable one. Resolving C2 through a blockchain naming system removes the registrar and the DNS takedown from the disruption playbook, the same way DeadLock's use of Polygon removes the hosting provider. Two unrelated crews reaching for the same property in the same month is a trend rather than a coincidence.

The command set was also consolidated from 43 text-named methods to 15 numbered commands, including UDP floods optimised for ARM. That is a maintenance decision — smaller protocol, less to fingerprint, less to break.

What to do

Unit 42's mitigation is short and, for once, entirely actionable by an ordinary IT team:

  • Segment Android TV boxes off enterprise networks. Meeting-room streaming devices, digital signage and lobby TVs are the ones sitting on corporate VLANs today.
  • Disable ADB, or restrict it to USB only. Network ADB has no legitimate use on a deployed device.
  • Block 5555 inbound at the network edge and between VLANs.

For anyone defending a website rather than a fleet, the practical takeaway is different: if your DDoS mitigation depends on distinguishing bots by their fingerprint, this class of traffic is designed to defeat it. Rate limiting per source, request-cost analysis and challenge flows do not care how convincing the headers are.