Kimwolf v7 Android botnet mimics browsers in HTTP/2 DDoS attacks
This digest was compiled by AI from multiple sources — links to the originals are below.
Palo Alto Networks Unit 42 has uncovered Kimwolf v7, a new version of the Android botnet that now uses HTTP/2 flood attacks with full browser fingerprints to mimic legitimate browsing. The botnet, which targets Android TV devices and Linux IoT systems, has also shifted to a decentralized command-and-control structure using Ethereum Name Service and Tor to evade takedowns. The operators have removed built-in scanning and exploit functionality, relying instead on an external loader for initial compromise.
HTTP/2 Browser Fingerprint Attacks
Kimwolf v7 introduces HTTP/2-based DDoS floods that construct complete browser fingerprints, making attack traffic indistinguishable from normal user activity. The malware leverages the nghttp2 library to craft requests that mirror legitimate browser behavior at both protocol and header levels. Unit 42 researchers note this is a significant evolution from earlier versions, which used simpler TCP or UDP floods.
Decentralized Command-and-Control
The botnet now relies on Ethereum Name Service (ENS) to resolve C2 addresses through legitimate public RPC services, adding a layer of decentralization. A hard-coded Tor .onion address serves as a backup C2 channel, with all bot traffic routed through a local proxy on 127.0.0.1:23075 that abstracts communication to both clearnet and Tor. This tiered infrastructure, combined with the removal of hard-coded IP addresses, makes takedowns more difficult.
Operational Security Overhaul
Kimwolf v7 has shed its scanning, exploitation, and brute-force modules, signaling a shift to a loader-based distribution model where initial access is achieved separately. The binary now contains only DDoS and proxy relay functionality, with attack commands consolidated from 43 text-named methods to 15 numbered ones. The malware also masks itself as a legitimate Android system process like 'netd_service' and targets ARM-based Android TV boxes with a specialized UDP flood function.
What's Next
Unit 42 expects Kimwolf operators to continue refining evasion techniques as DDoS mitigation tools improve. The use of ENS and Tor complicates takedown efforts, and researchers warn that the botnet's modular design could enable rapid adaptation to new targets.
1 source
Kimwolf v7 Android botnet mimics browsers in HTTP/2 DDoS attacks
