Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

Kimwolf botnet infects Android TV streaming boxes for DDoS and proxy abuse

Malware Activity
First reported
Last updated
Happening score
H score 36
2 unique sources, 4 articles

Summary

Hide ▲

Kimwolf/Aisuru botnet activity now spans Android TV streaming devices and record-setting DDoS attacks. Cloudflare says the latest campaign, “The Night Before Christmas,” peaked at 31.4 Tbps and 200 million requests per second, targeting mostly telecommunications companies and detected on December 19. The botnet’s broader abuse has included compromised IoT devices and routers, with earlier records of 29.7 Tbps and 15.72 Tbps also tied to Aisuru. Authorities from the United States, Germany, and Canada have now disrupted C2 infrastructure used by Aisuru, KimWolf, JackSkid, and Mossad to infect IoT devices and launch hundreds of thousands of DDoS attacks.

Related Happenings

Kimwolf operators build a cybercrime-as-a-service DDoS access market

Threat Actor Meta
First: 22.05.2026 11:50 Last: 22.05.2026 11:50 Sources 1

About this happening: The **Kimwolf** operators ran a **cybercrime-as-a-service** market that sold access to infected devices, widening **DDoS-for-hire** abuse. The model turned compromised **digital p...

Open Happening

Dort-linked DDoS, doxing, and swatting campaign against researchers

Campaign
First: 22.05.2026 00:50 Last: 22.05.2026 00:50 Sources 1

About this happening: The **Dort**-linked harassment campaign targeted **this author and a security researcher**, using **DDoS, doxing, and swatting** to intimidate the people investigating the operato...

Open Happening

Brazilian ISP botnet DDoS campaign

Campaign
First: 30.04.2026 17:04 Last: 30.04.2026 17:04 Sources 1

About this happening: The **Brazilian ISP botnet DDoS campaign** has been linked to a **Brazil-based threat actor** that repeatedly hit **Brazilian network operators** over several years. The operation...

Open Happening

APT28 FrostArmada DNS hijacking and AitM credential theft campaign

Campaign
First: 07.04.2026 18:51 Last: 07.04.2026 18:51 Sources 1

About this happening: A multinational disruption effort has taken down **FrostArmada**, an **APT28** campaign that hijacked router DNS settings to steal **Microsoft account credentials** and OAuth toke...

Open Happening

APT28 SOHO router DNS hijacking and credential theft campaign

Campaign
First: 07.04.2026 18:30 Last: 07.04.2026 18:30 Sources 1

About this happening: **APT28** is running **two malicious campaigns** that abuse **vulnerable SOHO routers** and attacker-controlled **DNS/VPS infrastructure** to reroute traffic and steal credentials...

Latest development: 08.04.2026 13:03

On April 7, 2026, the US Department of Justice and the FBI said they neutralized the US portion of APT28’s DNS hijacking network, which spanned more than 23 US states and used compromised SOHO routers, especially TP-Link routers, to redirect traffic through attacker-controlled DNS servers and steal credentials from targeted organizations. The FBI said it was working with ISPs to notify affected users, and court-authorized remediation steps can reset router DNS settings, remove APT28-installed resolvers, and prevent further abuse of the original access path.

Open Happening

Timeline

  1. 20.03.2026 10:05 1 articles · 2mo ago

    U.S., Germany, and Canada take down Aisuru and KimWolf C2 infrastructure

    Legal Policy Action Update

    Authorities from the United States, Germany, and Canada disrupted Command and Control (C2) infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets to infect Internet of Things (IoT) devices and launch hundreds of thousands of DDoS attacks, including attacks against IP addresses owned by the Department of Defense Information Network (DoDIN).

    Show sources
    Open in new tab
  2. 26.01.2026 18:11 2 articles · 4mo ago

    Kimwolf gains unauthorized access to Badbox 2.0 panel

    Campaign Scope Update

    Kimwolf botmasters appear to have gained unauthorized access to the Badbox 2.0 botnet control panel, which could let them load Kimwolf malware directly onto Android TV boxes associated with Badbox 2.0.

    Show sources
    Open in new tab
  3. 09.01.2026 01:23 1 articles · 4mo ago

    Kimwolf proxy traffic observed on a Resi Rack IP

    Detection Ioc Update

    A Resi Rack Internet address was already being used by Kimwolf to direct proxy traffic, showing the botnet's residential-proxy infrastructure was active by November 24, 2025.

    Show sources
    Open in new tab
  4. 09.01.2026 01:23 1 articles · 4mo ago

    XLab links Kimwolf and Aisuru to the same infrastructure

    Attribution Update

    XLab confirmed that Kimwolf and Aisuru were being distributed from the same Internet address at 93.95.112[.]59, strengthening the attribution link between the two botnet strains and their operators.

    Show sources
    Open in new tab
  5. 09.01.2026 01:23 1 articles · 4mo ago

    Resi Rack receives Kimwolf notice and remediates abuse

    Mitigation Patch Update

    Resi Rack co-founder Cassidy Hales said the company received a December 10 notification about Kimwolf using its network and took care of the issue immediately after learning that a customer was leasing servers for the abuse.

    Show sources
    Open in new tab
  6. 09.01.2026 01:23 1 articles · 4mo ago

    Kimwolf operators retaliate against Synthient after public reporting

    Victim Impact Update

    Hours after the Kimwolf story was published, the resi[.]to Discord server was erased, Synthient's website was hit with a DDoS attack, and the Kimwolf botmasters used their botnet to dox Synthient founder Benjamin Brundage.

    Show sources
    Open in new tab
  7. 17.12.2025 02:00 2 articles · 5mo ago

    XLab publishes Kimwolf deep dive on DDoS and proxy abuse

    Initial Disclosure

    XLab published a deep dive on Kimwolf, describing infected devices being forced into DDoS attacks and abusive Internet traffic relaying for residential proxy services while also noting overlap with Aisuru.

    Show sources
    Open in new tab