Lumen disrupts AISURU and Kimwolf botnet by blocking over 550 C2 servers

Lumen’s Black Lotus Labs disrupted over 550 command-and-control servers tied to the AISURU and Kimwolf botnets, which have been used for DDoS attacks and proxy abuse. AISURU operates as a DDoS-for-hire service, with attacks reported to exceed 1.5 Tb/sec and generating more than 1 Tb/sec traffic from compromised customer premises equipment. The Kimwolf Android botnet, a newer addition linked to AISURU, infected more than 1.8 million devices and issued in excess of 1.7 billion DDoS commands in a three-day window.

The botnets’ capabilities include DDoS, proxy forwarding, reverse shell, and file management, with Kimwolf largely targeting TV boxes and employing DNS over TLS and elliptic-curve signatures to authenticate C2 commands. In September 2025, Lumen observed bot traffic to AISURU C2 servers rising from 50,000 to 200,000 daily, and by mid-October the Kimwolf infection scale had grown to hundreds of thousands of devices, prompting Lumen to null-route new infrastructure as it appeared. Over four months, the effort led to null-routing more than 550 AISURU/Kimwolf servers and sharing indicators with security partners to curb the threat.