Kimwolf Botnet Hijacks 1.8 Million Android TVs, Launches Large-Scale DDoS Attacks

A new distributed denial-of-service botnet called Kimwolf has enlisted at least 1.8 million infected devices, including Android-based TVs, set-top boxes and tablets, to launch large-scale DDoS attacks, according to findings from QiAnXin XLab. The researchers say Kimwolf is built with the Native Development Kit and supports proxy forwarding, reverse shell and file management alongside its DDoS capabilities.

Between 19 and 22 November 2025, the botnet is estimated to have issued about 1.7 billion DDoS attack commands, with one C2 domain briefly appearing in Cloudflare’s top 100 domains and even surpassing Google for a period. Primary infections target TV boxes in residential networks, with a global spread including Brazil, India, the U.S., Argentina, South Africa and the Philippines; however, the exact infection vector remains unclear.

XLab notes Kimwolf is tied to the AISURU botnet and that attackers may have reused code from AISURU, potentially collaborating or even leading the campaigns, while the botnet’s C2 infrastructure has undergone multiple takedowns and evasive upgrades, including the use of ENS to harden its network.