The Botnet That Learned From Its Takedown: Kimwolf Moves Beyond the Reach of a Court Order- 347
August 12, 2026
For two decades, the decisive move against a botnet has been administrative rather than technical: find the domain names its infected machines call home, persuade a registrar or a court to seize them, and the army falls silent. The newest version of Kimwolf, a botnet built mostly from hijacked Android TV boxes and set-top boxes, has been redesigned around the defeat of that move.
Palo Alto Networks’ Unit 42 reports that version 7, active since February 2026, resolves its command servers through the Ethereum Name Service, a naming directory stored on a public blockchain, and falls back on a Tor hidden service when that fails, leaving investigators with neither a company to serve nor a record to seize. It also disguises its attack traffic as ordinary Chrome browsing, the better to defeat the filters that absorb denial-of-service floods. The result is a case study in adaptive adversaries: every law-enforcement success of the past year is visible in the botnet’s new architecture, and the next takedown will have to be won on harder ground.
Kimwolf belongs to the family researchers also track as Aisuru, active since August 2024. The same operators run two codebases: Aisuru, aimed at Linux internet-of-things devices, and Kimwolf, which moved to Android TV boxes around August 2025. The botnet briefly reached the top of Cloudflare’s global domain rankings in late October 2025, a measure of the volume of traffic its bots generated, before a sequence of blows that reads like a model of coordinated disruption: two domain takedowns in December 2025; a court-authorised operation announced by the US Justice Department and international partners on 19 March 2026, which seized command infrastructure used by the Aisuru, Kimwolf, JackSkid and Mossad botnets; and, in May, the arrest of a Canadian man alleged to run the botnet and his extradition to the United States.
Version 7 answers each of those blows. Unit 42 found the variant on 3 February, through threat hunting that followed public disclosures by XLab, Synthient, Infoblox, Cloudflare and others, which means the redesigned botnet was already circulating a month before the March seizure. Its command addresses no longer sit in an ordinary domain that a registrar can surrender, but in records on a ledger replicated across thousands of computers; the malware consults several public blockchain gateways in shuffled order, so that blocking one changes little. Should all of them fail, the bots turn to a hidden service on the Tor network, which conceals where the server physically sits. Unit 42 also identified a further gateway, styled as a public service, that it assesses with moderate confidence to be run by the operators themselves. The defenders’ advice follows from the design: rather than blocking legitimate blockchain services outright, organisations should watch for unusual blockchain traffic coming from televisions, set-top boxes and other devices that have no reason to generate it.
The second innovation targets the victims of the attacks rather than the investigators. A flood is the crude core of a distributed denial-of-service attack, thousands of infected devices sending a target more requests than it can answer, and the standard defence is to recognise the fake traffic and drop it before it reaches the server. Kimwolf’s new flood mode rides on HTTP/2, the protocol that carries most web traffic, and reproduces complete browser fingerprints, copying Chrome’s behaviour. Traffic that looks like a real browser is not easily filtered, which leaves a site under attack with a poor choice between serving every request and collapsing, or turning away customers it cannot distinguish from bots.
The botnet’s raw material is a consumer market that security regulation has barely touched. Kimwolf spreads by abusing residential proxy services to reach Android devices inside home networks, exploiting boxes that ship with a debugging interface left open and unauthenticated, which allows installation without any password. Inexpensive streaming boxes, often bought on price alone, thus become the ammunition of attacks against companies and public services far away, and their owners rarely know. Unit 42’s analysis of the command infrastructure points to servers in Russia, four of which share the same SSH host key and sit in a single network registered in Saint Petersburg. Who built version 7 remains unclear: it may be the work of the original operators, despite the arrest, or of a new group exploiting the brand’s notoriety. Either way, the lesson for law enforcement is structural. Takedowns built on seizing domain names worked against Kimwolf twice in 2025 and once more in 2026, and its developers have now designed that lever away, which shifts the burden back to the devices themselves: the manufacturers that ship them open, the proxy services that tunnel into homes, and the networks that let televisions talk to blockchains unnoticed.
