Kimwolf
KimWolf is a cybercriminal botnet operation and Android-focused variant/splinter of Aisuru that emerged in 2025. It is widely described as one of the largest Android botnets, with reporting that it infected more than 2 million Android-based devices globally, including Android TV boxes, smart TVs, tablets, digital photo frames, and other low-cost or unofficial streaming devices. Multiple sources describe it as linked to or grown from Aisuru, and some reporting states KimWolf and Aisuru were likely operated by the same group. Known aliases in the provided content include kimwolf and kimwolf_operators. The operation is associated with large-scale DDoS activity and attack-for-rent services. Reporting in the provided content attributes roughly 25,000 attack commands to KimWolf and describes it as capable of record-setting attacks, including a 31.4 Tbps attack in December 2025 against Cloudflare, likely with assistance from Aisuru. The botnet is also described as monetizing access through proxy services and residential proxy resale, with administrators selling DDoS and proxy capabilities on cybercrime forums. KimWolf primarily targets insecure Android-based consumer devices, especially devices shipped with Android debugging enabled by default, preinstalled exploitable firmware, or malware present before sale. The content states it also abused residential proxy networks to reach internal network addresses and scan for exposed ADB services, including ports 5555, 5858, 12108, and 3222, and delivered payloads via shell scripts piped through netcat or telnet. Reporting further states KimWolf could infect devices traditionally hidden behind firewalls and use compromised Android TV devices to pivot into local networks and infect additional devices. The botnet’s command-and-control and resilience mechanisms include use of the ENS domain pawsatyou[.]eth and an ENS contract for resilient C2. Additional infrastructure mentioned in the content includes the previously used domain 14emeliaterracewestroxburyma02132[.]su and downloader IPs 93.95.112.50-59 associated with Resi Rack LLC. The content also states KimWolf leveraged residential proxies and a monetization chain involving Resi Rack LLC, IPIDEA, and the ByteConnect SDK, and that IPIDEA proxy services were used by KimWolf. Operationally, the content describes KimWolf as a technically advanced cybercriminal group characterized by rapid adaptation to takedowns, stealth, persistence, and rapid rebuilding of infrastructure. It has been described as using Mirai-style DDoS functionality while heavily emphasizing proxying; one source in the content states 96.5% of bot commands were proxy-related. The botnet has also been described as being used for ad fraud, account takeovers, and web scraping. The provided content references operators/admins using the aliases "Dort" and "Snow," and one report ties KimWolf administrators to British Columbia and Quebec in Canada and Hanover in Germany. Another cited source describes the actor as allegedly Russia-based, but this is not consistently supported across the content. The content also notes an international law-enforcement takedown in March 2026 targeting the command-and-control infrastructure of KimWolf, Aisuru, JackSkid, and Mossad.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Where they're from
Attributed origin per open-source reporting.
- CA
- BR
- US
- DE
Tradecraft
34 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Observables
8 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Multinational botnet operation targeting Android TV devices for DDoS-for-hire and residential proxy resale, using Mirai-derived malware, SOCKS proxying, ENS-based resilient C2, and trojanized APKs plus ADB exploitation.
Botnet used for large-scale DDoS attacks; noted as particularly capable of infecting devices traditionally hidden behind firewalls and rented out as attack infrastructure.
Botnet operation used for DDoS attacks; the content says Kimwolf mainly infects Android-based streaming devices such as TV boxes, Smart TVs, Android tablets, and digital photo frames, and was responsible for about 25,000 DDoS attacks.
Botnet involved in distributed-denial-of-service attacks using infected Internet-of-Things devices worldwide.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.