Kimwolf Android Botnet Infects Over 2 Million Devices via Exposed ADB and Proxy Networks

The Kimwolf Android botnet has infected more than 2 million Android devices by tunnelling through residential proxy networks and exposed Android Debug Bridge (ADB) services, according to Synthient. The attackers monetise the botnet by app installs, selling residential proxy bandwidth, and selling its DDoS functionality, the firm notes in its analysis. Kimwolf was first publicly documented by QiAnXin XLab last month and is linked to AISURU, with activity dating back to at least August 2025.

The bulk of infections are in Vietnam, Brazil, India, and Saudi Arabia, and Synthient observes about 12 million unique IP addresses per week. Attacks focus on devices running unauthenticated ADB shells, many of which are connected to proxy networks via 119 Byteconnect SDK relay servers, and the main payload listens on port 40860, connecting to 85.234.91[.]247:1337 for commands.

From December 2025, infections have leveraged IPIDEA proxy addresses, which IPIDEA has patched to block access to local network devices and sensitive ports.