RESEARCHERS at Palo Alto Networks have identified a new variant of the Kimwolf botnet, labelled Kimwolf v7, that is actively targeting Android TV boxes and other IoT devices. The malware distinguishes itself by using Ethereum‑based naming services and Chrome fingerprint spoofing to conceal its distributed denial‑of‑service traffic. Details of the campaign were first shared publicly on 3 February 2026 and have since been observed in the wild across multiple regions.
Kimwolf v7 launches HTTP/2‑based flooding campaigns that closely mimic legitimate web browsing, making the malicious traffic harder to separate from normal user activity. The botnet spoofes Chrome user‑agent strings and employs header manipulation to blend in with genuine browser sessions. For command‑and‑control it relies on the Ethereum Name Service to resolve dynamically changing addresses, while also maintaining hard‑coded endpoints for Ethereum RPC services.
The malware’s infrastructure is organised in three tiers: Ethereum Name Service for primary C2 resolution, a backup Tor hidden service for resilience, and a local proxy layer that can reroute traffic through compromised hosts. This design separates the DDoS module from the propagation component, allowing operators to update attack methods without redesigning the whole framework. The focus on Android TV boxes reflects a broader trend of attackers exploiting weakly secured smart‑home devices.
Although no specific threat actor has been linked to Kimwolf v7, the botnet has been seen active since early February 2026, with reports of infections in parts of Asia and Europe. Its use of blockchain‑based naming and decentralised routing illustrates how criminal groups are adopting technologies intended for legitimate purposes to evade takedowns. The lack of associated CVEs does not diminish the risk, as the danger lies in the behavioural tactics rather than a single software flaw.
Defenders should begin by ensuring that all Android TV boxes and similar IoT devices run the latest vendor firmware and that any unnecessary debugging interfaces such as ADB are disabled. Network administrators ought to monitor outbound HTTP/2 connections for requests to unusual .eth domains or to known Ethereum RPC endpoints, and consider blocking those destinations at the firewall. Detecting anomalies in Chrome‑like user‑agent strings combined with abnormal request rates can also help spot the malware’s traffic.
Beyond host‑level hardening, organisations should isolate IoT segments from critical networks, enforce strict outbound traffic policies, and leverage DNS filtering to prevent resolution of Ethereum‑related names. Sharing indicators of compromise with upstream providers and participating in threat‑intelligence groups can improve early warning. Regular hunting for the hard‑coded IP ranges associated with the botnet’s proxy layer will aid in uncovering hidden infections before they contribute to larger attack volumes.