Researchers Null-Route Over 550 Kimwolf and Aisuru Botnet Command Servers

According to The Black Lotus Labs team at Lumen Technologies, AISURU and its Android counterpart Kimwolf have become among the largest botnets, capable of directing enslaved devices to participate in DDoS attacks and relay malicious traffic for residential proxy services. They null-routed traffic to more than 550 Kimwolf/AISURU C2 nodes since early October 2025.

The botnet has previously been shown to infect over 2 million Android devices by exposing an Android Debug Bridge service and tunnelling traffic through residential proxies, turning devices into proxy nodes for sale on proxy networks. Black Lotus Labs noted a surge in bot addition in October 2025, with about 800,000 bots by mid-month, many listed for sale on a single residential proxy service.

The investigation also linked back-end C2 activity to domains and IPs tied to Resi Rack LLC and related proxy services, highlighting how compromised devices are exploited to scan local networks for vulnerable ADB-enabled devices. The report, dated 14 January 2026, emphasizes the scale and reach of Kimwolf/AISURU and the evolving use of consumer devices as conduits for multi-stage attacks.