Kimwolf Botnet Compromises 1.8 Million Android TVs for Massive DDoS Attacks

Kimwolf Botnet Hijacks Android TVs for DDoS Attacks

A new botnet, dubbed Kimwolf, has compromised 1.8 million Android-based TVs, set-top boxes, and tablets, and unleashed 1.7 billion DDoS attack commands in just three days. The botnet leverages the Ethereum Name Service (ENS) to obscure its command-and-control (C2) infrastructure.

Why This Matters

Current network security often struggles to effectively identify and mitigate DDoS attacks originating from within residential networks. The ideal model assumes perimeter security, but the proliferation of IoT devices like Android TVs creates a vast, distributed attack surface. The scale of the Kimwolf botnet—1.8 million devices—demonstrates the potential for significant disruption and financial losses for targeted services, potentially reaching millions of dollars in downtime and remediation costs.

Key Insights

• 1.7 Billion DDoS Commands: Kimwolf issued this many commands between November 19-22, 2025.
• ENS for C2 Hardening: The botnet employs Ethereum Name Service (ENS) to hide its command-and-control servers, making takedown attempts more difficult.
• AISURU Connection: Kimwolf shares code and infrastructure with the AISURU botnet, suggesting a common operator or collaboration.

Working Example

# Example of XOR operation used by Kimwolf to resolve C2 IP
def resolve_c2_ip(encoded_ip, key):
  """
  Resolves the C2 IP address using XOR decryption.

  Args:
    encoded_ip: The encoded IPv6 address (bytes).
    key: The XOR key (integer).

  Returns:
    The decoded IPv6 address (bytes).
  """
  decoded_ip = bytearray()
  for byte in encoded_ip:
    decoded_ip.append(byte ^ (key >> (0 if (byte % 2) == 0 else 1) & 0xFF))
  return bytes(decoded_ip)

# Example usage (replace with actual encoded IP and key)
encoded_ip = b'\x1a\x2b\x3c\x4d' # Example encoded IP
key = 0x93141715
decoded_ip = resolve_c2_ip(encoded_ip, key)
print(f"Decoded IP: {decoded_ip.hex()}")

Practical Applications

• ISP Monitoring: Internet Service Providers can monitor for unusual outbound traffic patterns from customer devices to identify potential botnet activity.
• Pitfall: Relying solely on signature-based detection is ineffective against botnets like Kimwolf that frequently update their code and C2 infrastructure. Proactive threat hunting and behavioral analysis are crucial.

References:

• https://thehackernews.com/2025/12/kimwolf-botnet-hijacks-18-million.html