The Kimwolf botnet, known for its distributed denial-of-service (DDoS) attacks, has reportedly been rebuilt with new features designed to evade detection and resist law enforcement takedowns. Researchers at Palo Alto Networks' Unit 42, who track the botnet as Kimwolf or Aisuru, detailed these changes in a report published this week. The updated version of the botnet has been active since February, predating an international law enforcement operation in March that seized infrastructure associated with previous iterations.
One significant change is a new HTTP/2 flood method. Unlike earlier versions that might send raw packets, the new Kimwolf variant mimics legitimate Chrome web browser traffic, complete with full browser fingerprints and header order. This makes it challenging for defensive systems to distinguish malicious traffic from genuine user requests, forcing targeted websites to either process all requests and risk collapse or block what appears to be legitimate customer traffic.
To enhance its resilience against takedowns, the botnet has altered its command-and-control (C2) communication strategy. Previously, C2 server addresses were embedded as standard domain names within the malware, making them vulnerable to seizure by registrars. The new version now retrieves its C2 addresses from the Ethereum Name Service (ENS), a decentralized naming system built on the Ethereum blockchain. This mechanism stores domain records across a distributed ledger, making them difficult for a single entity to seize or disrupt. The malware is programmed with five public ENS addresses, which it shuffles before each connection attempt, further complicating blocking efforts.
As a fallback, if all five ENS addresses fail, the botnet is configured to connect to a fixed Tor hidden service address. Tor's network architecture obscures the physical location of the server, providing an additional layer of anonymity and making it harder for investigators to identify and target the host. Unit 42's infrastructure analysis suggests that the servers powering the botnet's command structure are located in Russia, with four sharing an SSH host key and residing within a single network registered in Saint Petersburg.
The Kimwolf botnet primarily compromises Android TV boxes and other internet-connected devices. It gained notoriety in late October 2025 when it briefly topped Cloudflare's global domain rankings. The March law enforcement operation led to the seizure of Kimwolf's infrastructure, and a Canadian man alleged to be an operator was arrested in May and subsequently extradited to the United States. It remains unclear whether the developers behind this new version are the same individuals responsible for previous iterations or a new group capitalizing on the botnet's reputation.
