KimwolfMalware
KIMWOLF is an android based malware which uses compromised systems to relay malicious and abusive Internet traffic, as well as participating in distributed denial-of-service (DDoS). KIMWOLF primarily infects unofficial Android-TV set-top boxes and digital photo frames. The malware has frequently been noted to achieve infection spread via abusing Android Debug Bridge (ADB) and residential proxies.From MISP Galaxy
Last reported 8 days ago, by Help Net Security6 reports
ATT&CK techniques
3 techniques · each with the sentence it comes from- T1684Social Engineering
“The attackers used fake Booking.com reservation cancellations, social engineering with simulated blue screens of death (BSODs), and trusted MSBuild.exe abuse to deploy DCRat for remote access and secondary payload delivery.”
- T1195Supply Chain Compromise
“Supply-chain compromise of Trivy vulnerability scanner”
- T1218.002Control Panel
“DDoS-for-hire services offer subscription plans, free trials, method catalogues and control panels with preconfigured settings that reduce the technical effort needed to launch attacks.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
6 reports, newest first · the exact sentence from each-
DDoS attacks can knock services offline before links reach capacity“Much of that growth came from botnet operators associated with Aisuru, Kimwolf, Jackskid, and their successors.”
-
Anthropic conjures another threat that doesn't exist yet to stoke fears of AI apocalypse“…worm could also suss out the workings of unfamiliar devices, potentially making it more adaptable than conventional botnets like Mirai, Kimwolf (the representative IoT botnet threat model used in the study), and others.”
-
Anthropic Shows How Small AI Models Could Replicate Across IoT Devices“Past botnets like Mirai or Kimwolf, which infected over two million Android TV boxes at its peak, were hardcoded for specific device types and specific exploits.”
-
Small AI Models May Soon Be Able to Self-Replicate on IoT Devices, Anthropic Warns“Anthropic also looked at a botnet as large as Kimwolf, which infected more than two million devices.”
-
Cyber Brief 26-02 - January 2026“In regards to cybercrime, a new Russia-linked ClickFix campaign targeted European hospitality organisations, while the global Kimwolf botnet reportedly expanded, exploiting residential proxy networks.”
-
Cyber Brief 26-04 - March 2026“On March 20, a joint global law enforcement operation including the US, Germany, and Canada, disrupted the Aisuru, Kimwolf, Jackskid and Mossad botnets, whose malware droppers infected thousands of devices.”
Thanks — we review every report.