Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
The Kimwolf/AISURU Android and Internet of Things (IoT) botnet has undergone substantial modifications to increase its operational resilience and carry out distributed denial-of-service (DDoS) assaults, according to cybersecurity researchers.
Palo Alto Networks Unit 42 found the updated version, known as Kimwolf v7, in February 2026.
According to researchers Asher Davila, Chris Navarrete, and Doel Santos, Kimwolf v7 includes an HTTP/2-based DDoS flood that creates full browser fingerprints. As a result, it becomes more challenging to discern between genuine browsing and attack activity.
Additionally, the botnet uses a tiered system that uses Ethereum Name Service (ENS) to retrieve the C2 address, a hard-coded Tor, in order to make its command-and-control (C2) infrastructure more ...