New Kimwolf botnet variant: analysis of version v7

On February 3, 2026, security researchers discovered a new variant of the Kimwolf botnet, also known as AISURU. This variant, dubbed v7, represents a significant evolution from previous versions, with new evasion capabilities and a more resilient command and control (C2) structure.

Historical context

The Kimwolf botnet has been active since August 2024, initially targeting Linux IoT devices under the name AISURU. From August 2025, it shifted its focus to Android TV boxes. This transition reflects two separate codebases managed by the same operators: AISURU for Linux IoT variants and Kimwolf for Android variants.

Spread methods

Kimwolf spreads by exploiting residential proxy services to reach unauthenticated instances of Android Debug Bridge (ADB) on local networks. Some Android TV boxes come with ADB enabled on port 5555. Once attackers tunnel through a proxy endpoint in the local network, they can install the malware without any authentication.

Technical features of the v7 variant

Binary structure

The analyzed Kimwolf v7 sample is an ELF (Executable and Linkable Format) binary for ARM, statically linked. It was compiled with the Android Native Development Kit (NDK) using Clang and uses Bionic libc. The binary statically links BoringSSL for TLS operations and nghttp2 for HTTP/2 functionality.

The binary has been stripped but retains some symbol information. Previous version names included racist expressions, which have been partially censored in this analysis to allow security experts to identify the variant.

New attack capabilities

One of the most significant new capabilities of Kimwolf v7 is an HTTP/2 flood powered by the nghttp2 library. This feature builds complete browser fingerprints, making it difficult to distinguish attack traffic from legitimate browser requests.

C2 resolution system

Kimwolf v7 uses a layered C2 resolution system designed to survive domain seizures that disrupted the botnet twice in December 2025. The binary contains five hard-coded public endpoints based on Ethereum for resolving Ethereum Name Service (ENS) domains. These legitimate endpoints are used to resolve C2 addresses.

The malware mixes these endpoints using a pseudo-random number generator (PRNG) before each resolution attempt. The five-way redundancy makes it more difficult to block ENS-based C2 resolution.

Tor infrastructure

When ENS resolution fails, the v7 binary falls back to a hard-coded v3 Tor .onion address. The malware manages Tor protocol states by sending a greeting, building a CONNECT request with the .onion address, and waiting for the response.

Kimwolf v7 also uses a local proxy architecture. All C2 traffic passes through a local proxy on 127.0.0[.]1:23075, whether it is destined for the clearnet or Tor. This modular design allows the proxy component to be updated independently of the main bot binary.

C2 infrastructure

Analysis of Kimwolf v7 samples revealed C2 connections to several IP addresses, including:

• 212.193.31[.]119 and 212.193.31[.]122 on TCP port 13

None of these IPs were previously associated with Kimwolf or AISURU.

Impact and mitigation

The v7 variant represents a significant evolution in botnet capabilities, requiring a more sophisticated approach to defense. International collaboration, adoption of advanced detection technologies, and a deep understanding of attacker tactics are essential to counter this evolving threat.

Staying informed through reliable sources and actively participating in the security community are crucial steps to protect digital infrastructures in an increasingly complex threat landscape.