‘Kimwolf’ Android Botnet Ensnares 1.8 Million Devices

‘Kimwolf’ Android botnet has infected over 1.8 million devices and can launch massive DDoS attacks, according to XLab. The botnet, linked to the Aisuru IoT botnet, mainly focuses on traffic proxying and was observed issuing over 1.7 billion DDoS attack commands between 19 and 22 November. Its C&C domain, 14emeliaterracewestroxburyma02132[.]su, rose to the top in Cloudflare’s global domain popularity rankings, surpassing google[.]com.

Kimwolf relies on the DNS over TLS protocol to encapsulate DNS requests and uses a signature verification mechanism to validate instructions. The malware primarily infects Android TV set-top boxes deployed on residential networks and has infected devices across more than 220 countries and regions. According to XLab, the botnet’s attack capability is close to 30 Tbps, though the total size remains uncertain due to dynamic IP allocations.