Massive Android botnet Kimwolf infects millions, strikes with DDoS

The Kimwolf Android botnet has infected 1.8M+ devices and issued more than 1.7 billion DDoS commands, according to XLab. Researchers first noted a standout C2 domain on October 24, 2025, and within a week its popularity rose, with the botnet reportedly surpassing Google in Cloudflare’s global rankings.

Built to target TV boxes and using the wolfSSL library, Kimwolf combines DDoS, proxy forwarding, reverse shell and file management functions, and it communicates via DNS over TLS with elliptic curve signatures for C2 verification. By December 1, researchers counted over 3.66 million cumulative infected IPs, peaking at about 1.83 million on December 4, while takedowns on multiple C2s forced reconfiguration and reduced daily active nodes to around 200,000.

Observations suggest Kimwolf’s DDoS capacity approaches 30 Tbps, with infections detected in 222 countries, and high-profile attacks confirmed on November 23 and December 9. The botnet appears to share scripts with the Aisuru family and continues to evolve to evade takedowns.