The Wolf Among TVs: 1.8 Million-Strong Kimwolf Botnet Surpasses Google Traffic to Rule the IoT

The Wolf Among TVs: 1.8 Million-Strong Kimwolf Botnet Surpasses Google Traffic to Rule the IoT reports that Chinese cybersecurity firm QiAnXin has released a report detailing Kimwolf, a newly identified DDoS botnet that has already compromised at least 1.8 million devices worldwide, mainly Android-based smart TVs, set-top boxes and tablets.

It is compiled with the native development kit and goes beyond typical DDoS, including proxy forwarding, reverse shell access and file management capabilities that enable attackers to conscript devices for broader offensive operations. According to QiAnXin, between 19 and 22 November 2025 the botnet issued as many as 1.7 billion DDoS commands, pushing its command-and-control domain 14emeliaterracewestroxburyma02132[.]su to the top of Cloudflare’s DNS rankings and even surpassing Google Search during that period.

Infections span multiple regions with models such as TV BOX, SuperBOX, HiDPTAndroid, P200, X96Q, XBOX, SmartTB and MX10 affected, and some campaigns may be linked to AISURU. Users are urged to check for default passwords, apply available firmware updates, and reset devices if unusual behaviour is detected.