Researchers Null-Route Over 550 Kimwolf and Aisuru Botnet Command Servers
Since early October 2025, the Black Lotus Labs team at Lumen Technologies claimed to have null-routed traffic to over 550 command-and-control (C2) nodes connected to the AISURU/Kimwolf botnet.
AISURU and its Android counterpart, Kimwolf, have become some of the largest botnets in recent years. They can provide malicious traffic for residential proxy services and instruct enslaved devices to take part in distributed denial-of-service (DDoS) assaults.
Details about Kimwolf surfaced last month when QiAnXin XLab released a thorough analysis of the malware, which uses a software development kit (SDK) called ByteConnect, either directly or through dubious pre-installed apps, to turn compromised devices—mostly unapproved Android TV streaming devices—into a residential proxy.
As a result...