Skip to main content
Mallory
🇨🇦 🇧🇷 🇺🇸 🇩🇪 CA1 malware family

Kimwolf

Also known askimwolfkimwolf_operators

KimWolf is a cybercriminal botnet operation and Android-focused variant/splinter of Aisuru that emerged in 2025. It is widely described as one of the largest Android botnets, with reporting that it infected more than 2 million Android-based devices globally, including Android TV boxes, smart TVs, tablets, digital photo frames, and other low-cost or unofficial streaming devices. Multiple sources describe it as linked to or grown from Aisuru, and some reporting states KimWolf and Aisuru were likely operated by the same group. Known aliases in the provided content include kimwolf and kimwolf_operators. The operation is associated with large-scale DDoS activity and attack-for-rent services. Reporting in the provided content attributes roughly 25,000 attack commands to KimWolf and describes it as capable of record-setting attacks, including a 31.4 Tbps attack in December 2025 against Cloudflare, likely with assistance from Aisuru. The botnet is also described as monetizing access through proxy services and residential proxy resale, with administrators selling DDoS and proxy capabilities on cybercrime forums. KimWolf primarily targets insecure Android-based consumer devices, especially devices shipped with Android debugging enabled by default, preinstalled exploitable firmware, or malware present before sale. The content states it also abused residential proxy networks to reach internal network addresses and scan for exposed ADB services, including ports 5555, 5858, 12108, and 3222, and delivered payloads via shell scripts piped through netcat or telnet. Reporting further states KimWolf could infect devices traditionally hidden behind firewalls and use compromised Android TV devices to pivot into local networks and infect additional devices. The botnet’s command-and-control and resilience mechanisms include use of the ENS domain pawsatyou[.]eth and an ENS contract for resilient C2. Additional infrastructure mentioned in the content includes the previously used domain 14emeliaterracewestroxburyma02132[.]su and downloader IPs 93.95.112.50-59 associated with Resi Rack LLC. The content also states KimWolf leveraged residential proxies and a monetization chain involving Resi Rack LLC, IPIDEA, and the ByteConnect SDK, and that IPIDEA proxy services were used by KimWolf. Operationally, the content describes KimWolf as a technically advanced cybercriminal group characterized by rapid adaptation to takedowns, stealth, persistence, and rapid rebuilding of infrastructure. It has been described as using Mirai-style DDoS functionality while heavily emphasizing proxying; one source in the content states 96.5% of bot commands were proxy-related. The botnet has also been described as being used for ad fraud, account takeovers, and web scraping. The provided content references operators/admins using the aliases "Dort" and "Snow," and one report ties KimWolf administrators to British Columbia and Quebec in Canada and Hanover in Germany. Another cited source describes the actor as allegedly Russia-based, but this is not consistently supported across the content. The content also notes an international law-enforcement takedown in March 2026 targeting the command-and-control infrastructure of KimWolf, Aisuru, JackSkid, and Mossad.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

OPERATIONAL PROFILE

Targeting

Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.

Where they're from

Attributed origin per open-source reporting.

  • CA
  • BR
  • US
  • DE
MITRE ATT&CK

Tradecraft

34 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

11 of 15 tactics40 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1595×3
Active Scanning
TA0042
Resource Development
2 techniques
T1583
Acquire Infrastructure
T1584
Compromise Infrastructure
T1584.005×4
Botnet
T1584.008
Network Devices
TA0001
Initial Access
5 techniques
T1078×2
Valid Accounts
T1133
External Remote Services
T1190×6
Exploit Public-Facing Application
T1195×2
Supply Chain Compromise
T1566
Phishing
TA0002
Execution
1 technique
T1059×3
Command and Scripting Interpreter
T1059.004×2
Unix Shell
TA0003
Persistence
2 techniques
T1078×2
Valid Accounts
T1133
External Remote Services
TA0004
Privilege Escalation
1 technique
T1078×2
Valid Accounts
TA0005
Stealth
3 techniques
T1036
Masquerading
T1070
Indicator Removal
T1070.004
File Deletion
T1078×2
Valid Accounts
TA0007
Discovery
3 techniques
T1016
System Network Configuration Discovery
T1016.001
Internet Connection Discovery
T1046×6
Network Service Discovery
T1083
File and Directory Discovery
TA0008
Lateral Movement
2 techniques
T1021
Remote Services
T1210×3
Exploitation of Remote Services
TA0011
Command and Control
8 techniques
T1001
Data Obfuscation
T1071×9
Application Layer Protocol
T1071.001
Web Protocols
T1090×7
Proxy
T1090.002×2
External Proxy
T1090.003×4
Multi-hop Proxy
T1102
Web Service
T1102.002
Bidirectional Communication
T1105×3
Ingress Tool Transfer
T1568×2
Dynamic Resolution
T1571
Non-Standard Port
T1573×2
Encrypted Channel
TA0040
Impact
3 techniques
T1496×3
Resource Hijacking
T1498×21
Network Denial of Service
T1499
Endpoint Denial of Service
IOCS

Observables

8 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

ACTIVITY FEED

Recent activity

20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping34

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal1

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables8

Domains, IPs, and hashes tied to this actor, refreshed continuously.