Kimwolf botnet leverages residential proxies to hijack 2M+ Android devices

The Kimwolf botnet has infected over 2 million Android devices, spreading mainly through residential proxy networks, according to Synthient. The campaign targets low-cost, unofficial Android TV boxes and many devices are sold pre-infected with modified software that turns them into Kimwolf bots. Researchers noted a sample from 24 October 2025 with a stand-out C2 domain and a three-day burst of activity that produced around 1.7 billion DDoS commands, with the botnet using the wolfSSL library.

Kimwolf’s infrastructure spans multiple C2s and time zones, and the malware can perform proxy forwarding, DDoS, reverse shell and file management, aided by DNS over TLS to hide communications and elliptic curve digital signatures to authenticate C2 commands.

The campaign has seen thousands of devices exposed via insecure proxy ecosystems, with about 67% of devices in residential proxy pools unauthenticated and vulnerable to remote code execution, and it even monetises infections by installing third‑party proxy SDKs such as Byteconnect. The report notes that Kimwolf’s rapid growth is facilitated by exploiting exposed ADB services through residential proxies, creating a large network of compromised devices and IP addresses.