Who Benefited from the Aisuru and Kimwolf Botnets?

According to XLab, Kimwolf infected more than two million Android TV streaming boxes and shared code with an earlier Aisuru botnet, with both strains being distributed by the same Internet address on 8 December 2025. Public records point to Lehi, Utah-based Resi Rack LLC as the host of some of the infrastructure used to support proxy services tied to the botnets, with co-founder Cassidy Hales commenting on the issue.

The same investigation names several individuals and entities linked to monetising proxy networks, including Benjamin Brundage of Synthient, and the resito Discord community that shared IP addresses used to proxy traffic for Kimwolf; a Telegram channel later alleged control by Dort and Snow of about 3.5 million infected devices.

A December 2025 sequence shows the use of ByteConnect, Plainproxies and 3XK Tech GmbH in related proxy services, with 3XK Tech highlighted by Cloudflare as a major source of application-layer DDoS traffic in 2025. The article also notes that a December 2025 Discord activity and subsequent takedowns coincided with policy shifts by major ISPs, including AT&T’s July 2025 update on routing, which constrained proxy networks and influenced actors involved in selling ISP proxies.