A botnet built out of cheap Android TV boxes has learned to make its attack traffic look like a person browsing the web. Palo Alto Networks' Unit 42 has published an analysis of Kimwolf v7, a new version of a family that has been running since August 2024, with upgrades aimed squarely at the two things that hurt it most: traffic filtering and server takedowns. The research is credited to Asher Davila, Chris Navarrete and Doel Santos.
Why the flood is harder to filter
The headline change is a denial of service capability built on HTTP/2, the modern version of the protocol browsers use. Rather than firing off crude, obviously-automated requests, the new module assembles complete browser fingerprints, the collection of headers and connection settings that make a request look like it came from Chrome on a real laptop. Unit 42's point is blunt: this makes the attack traffic difficult to distinguish from legitimate browsing, which is exactly the property that defeats simple rate limiting and signature-based scrubbing.
Where it lives, and how it gets there
Kimwolf primarily affects Android TV boxes and set-top boxes, the inexpensive streaming devices sold in enormous volumes and patched by almost nobody. It spreads by misusing residential proxy services to reach Android Debug Bridge (ADB) instances inside home and office networks. ADB is a developer interface, and some Android TV boxes ship with it enabled and unauthenticated on port 5555. Once the operators tunnel through a proxy endpoint into the local network, they can install the malware without any credentials at all.
The family is also tracked as AISURU, and Unit 42 describes two codebases under the same operators: AISURU covering the Linux internet-of-things variants, and Kimwolf covering the Android ones after the shift to TV boxes around August 2025. The analyzed sample is a statically linked ARM binary compiled with the Android NDK, and it masks its own process name as netd_service to sit unnoticed among genuine Android system processes. The malware authors have historically embedded a racial slur in their internal version strings, a practice Unit 42 flags and partially redacts while preserving enough for defenders to fingerprint the build.
Built to survive a takedown
The infrastructure changes are a direct answer to enforcement. The botnet's command servers were disrupted twice in December 2025, and v7 responds with three layers of fallback. The binary carries five hard-coded public Ethereum endpoints used to resolve Ethereum Name Service domains, a blockchain-based naming system, into command server addresses. Because those records live on a public ledger rather than in a registrar's database, there is no registrar to serve a takedown notice on. Behind that sits a hard-coded Tor hidden service as a backup, plus a local proxy component that lets the malware switch between the open internet and Tor as conditions require.
This is now a pattern rather than an experiment. IntelFusions reported in July on a separate 200,000-device botnet that moved its servers onto the blockchain for the same reason. Operators are converging on infrastructure that law enforcement and hosting providers cannot simply switch off.
What you should do
For network defenders the practical steps are unglamorous. Treat consumer streaming hardware on your network as untrusted, and check whether anything is listening on TCP port 5555, which should never be exposed. Watch for outbound connections from unexpected devices to public Ethereum RPC services, which is unusual traffic from a set-top box in any legitimate scenario. Unit 42 discovered this variant on February 3, 2026 through threat hunting that followed public disclosures by XLab, Synthient, Infoblox, Cloudflare and others, and clustered six samples on shared build artifacts, overlapping hosting and consistent process masquerading.
Defanged infrastructure named in the report includes 212[.]193[.]31[.]119, 212[.]193[.]31[.]122 and 23[.]94[.]221[.]104, with the full hash and endpoint list in Unit 42's write-up.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.