Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Kimwolf botnet infects Android TV streaming boxes for DDoS and proxy abuse

Malware Activity
First reported
Last updated
Happening score
H score 16
2 unique sources, 4 articles

Summary

Hide ▲

Kimwolf/Aisuru botnet activity now spans Android TV streaming devices and record-setting DDoS attacks. Cloudflare says the latest campaign, “The Night Before Christmas,” peaked at 31.4 Tbps and 200 million requests per second, targeting mostly telecommunications companies and detected on December 19. The botnet’s broader abuse has included compromised IoT devices and routers, with earlier records of 29.7 Tbps and 15.72 Tbps also tied to Aisuru. Authorities from the United States, Germany, and Canada have now disrupted C2 infrastructure used by Aisuru, KimWolf, JackSkid, and Mossad to infect IoT devices and launch hundreds of thousands of DDoS attacks.

Related Happenings

Popa botnet forcing consumer TV boxes to relay traffic

Malware Activity
H score76 First: 18.06.2026 20:37 Last: 18.06.2026 20:37 Sources 1

About this happening: **Popa** is an **Android-based botnet** that turns **consumer TV boxes** and related devices into relay infrastructure, maintaining encrypted connectivity and opening tunnels on d...

Latest development: 03.07.2026 12:35

Google disabled NetNut accounts used for malware command-and-control, updated Google Play Protect to warn Android users, and disabled apps containing compromised SDKs while FBI legal actions and domain seizures targeted NetNut infrastructure. The coordinated disruption was described as degrading NetNut’s proxy network and shrinking the pool of devices available to the operator.

Open Happening

Vo1d botnet campaign targeting unofficial Android-based TV boxes

Campaign
H score88 First: 18.06.2026 20:37 Last: 18.06.2026 20:37 Sources 1

About this happening: **NetNut** used the **Popa botnet** and deceptive SDKs on **off-brand Android-based smart TVs**, streaming media boxes, and unofficial apps to turn home connections into **residen...

Latest development: 03.07.2026 12:35

Google disabled all Google accounts used by NetNut for malware command-and-control, updated Google Play Protect to warn Android users, and disabled apps containing the compromised SDKs. The FBI’s seizure banner appeared on netnut.com while netnut.io briefly remained accessible, and Google said the coordinated actions caused significant degradation to NetNut’s proxy network and business operations.

Open Happening

Kimwolf operators build a cybercrime-as-a-service DDoS access market

Threat Actor Meta
H score24 First: 22.05.2026 11:50 Last: 22.05.2026 11:50 Sources 1

About this happening: The **Kimwolf** operators ran a **cybercrime-as-a-service** market that sold access to infected devices, widening **DDoS-for-hire** abuse. The model turned compromised **digital p...

Open Happening

Dort-linked DDoS, doxing, and swatting campaign against researchers

Campaign
H score38 First: 22.05.2026 00:50 Last: 22.05.2026 00:50 Sources 1

About this happening: The **Dort**-linked harassment campaign targeted **this author and a security researcher**, using **DDoS, doxing, and swatting** to intimidate the people investigating the operato...

Open Happening

Brazilian ISP botnet DDoS campaign

Campaign
H score36 First: 30.04.2026 17:04 Last: 30.04.2026 17:04 Sources 1

About this happening: The **Brazilian ISP botnet DDoS campaign** has been linked to a **Brazil-based threat actor** that repeatedly hit **Brazilian network operators** over several years. The operation...

Open Happening

Timeline

  1. 20.03.2026 10:05 1 articles · 3mo ago

    U.S., Germany, and Canada take down Aisuru and KimWolf C2 infrastructure

    Legal Policy Action Update

    Authorities from the United States, Germany, and Canada disrupted Command and Control (C2) infrastructure used by the Aisuru, KimWolf, JackSkid, and Mossad botnets to infect Internet of Things (IoT) devices and launch hundreds of thousands of DDoS attacks, including attacks against IP addresses owned by the Department of Defense Information Network (DoDIN).

    Show sources
    Open in new tab
  2. 26.01.2026 18:11 2 articles · 5mo ago

    Kimwolf gains unauthorized access to Badbox 2.0 panel

    Campaign Scope Update

    Kimwolf botmasters appear to have gained unauthorized access to the Badbox 2.0 botnet control panel, which could let them load Kimwolf malware directly onto Android TV boxes associated with Badbox 2.0.

    Show sources
    Open in new tab
  3. 09.01.2026 01:23 1 articles · 6mo ago

    Kimwolf proxy traffic observed on a Resi Rack IP

    Detection Ioc Update

    A Resi Rack Internet address was already being used by Kimwolf to direct proxy traffic, showing the botnet's residential-proxy infrastructure was active by November 24, 2025.

    Show sources
    Open in new tab
  4. 09.01.2026 01:23 1 articles · 6mo ago

    XLab links Kimwolf and Aisuru to the same infrastructure

    Attribution Update

    XLab confirmed that Kimwolf and Aisuru were being distributed from the same Internet address at 93.95.112[.]59, strengthening the attribution link between the two botnet strains and their operators.

    Show sources
    Open in new tab
  5. 09.01.2026 01:23 1 articles · 6mo ago

    Resi Rack receives Kimwolf notice and remediates abuse

    Mitigation Patch Update

    Resi Rack co-founder Cassidy Hales said the company received a December 10 notification about Kimwolf using its network and took care of the issue immediately after learning that a customer was leasing servers for the abuse.

    Show sources
    Open in new tab
  6. 09.01.2026 01:23 1 articles · 6mo ago

    Kimwolf operators retaliate against Synthient after public reporting

    Victim Impact Update

    Hours after the Kimwolf story was published, the resi[.]to Discord server was erased, Synthient's website was hit with a DDoS attack, and the Kimwolf botmasters used their botnet to dox Synthient founder Benjamin Brundage.

    Show sources
    Open in new tab
  7. 17.12.2025 02:00 2 articles · 6mo ago

    XLab publishes Kimwolf deep dive on DDoS and proxy abuse

    Initial Disclosure

    XLab published a deep dive on Kimwolf, describing infected devices being forced into DDoS attacks and abusive Internet traffic relaying for residential proxy services while also noting overlap with Aisuru.

    Show sources
    Open in new tab