Kimwolf v7 drops its scanner and dresses its floods up as Chrome

Palo Alto Networks Unit 42 says it found a seventh version of the Kimwolf botnet on Feb. 3, 2026, during threat hunting that followed public disclosures by XLab, Synthient, Infoblox and Cloudflare ^[1]. The build matters less for what it adds than for what it removes: the flood module now constructs complete browser fingerprints over HTTP/2, the command-and-control path hides behind Ethereum Name Service lookups and a Tor hidden service, and all scanning, exploitation and brute-force code is gone ^[2][3][4].

The flood function, identified in the binary as attack_case17_http2_flood, is built on the nghttp2 library and constructs complete browser fingerprints, which Unit 42 says makes the traffic harder to distinguish from legitimate browsing ^[5][2]. The Hacker News, summarising the same research, describes the fingerprints as mirroring legitimate browser behaviour at the protocol and header level ^[6]. Anyone whose mitigation rests on protocol quirks or header ordering is being asked to do behavioural work instead.

On resilience, the binary carries five hard-coded public Ethereum RPC endpoints in plaintext, used to query ENS records and resolve C2 addresses ^[7]. A hard-coded .onion hidden service serves as backup ^[8], and a local proxy at 127.0.0.1:23075 carries all C2 traffic regardless of whether it is bound for clearnet or Tor ^[9]. Unit 42 attributes this layering directly to C2 takedown efforts in December 2025, which disrupted the botnet twice that month ^[10][11]. The new build surfaced roughly two months later ^[12].

The command surface shrank at the same time. Kimwolf v7 consolidates DDoS commands into 15 numbered methods, down from 43 text-named methods in prior versions ^[13], a cut of 28 methods, or about 65 percent ^[14]. Numbered methods also remove the command strings themselves from a binary that is stripped but retains some symbol information ^[15]. A new UDP flood is tuned for the ARM processors in Android TV boxes ^[16].

The deletion of the scanner is the part with commercial implications. According to The Hacker News's account of the research, removing the scanner and exploit modules indicates the operators have split the propagation pipeline from the core payload, offloading initial access to an external loader while the Kimwolf binary handles DDoS and proxy relay ^[4]. The propagation it no longer performs itself is well documented: abuse of residential proxy services to reach unauthenticated Android Debug Bridge instances on local networks, on boxes that ship with ADB enabled on port 5555, allowing installation with no authentication ^[17][18]. Unit 42 also identified eight APK artefacts between October and December 2025 that masquerade as a system service called SystemService, probe for root and execute a bundled ELF payload ^[19], and notes a filename change from libn[redacted]kernel.so to libdevice.so in November 2025 that was reverted in December, which it reads as active operational security adjustment ^[20].

Context for scale: the operation has been active since August 2024, began as AISURU against Linux IoT, and moved to Android TV boxes around August 2025, with Unit 42 describing two codebases under the same operators ^[21][22][23]. The baseline sample is a statically linked ARM ELF built with the Android NDK and Clang against Bionic libc, statically linking BoringSSL and nghttp2 ^[24]. Six samples were clustered on shared ELF section layout, the same Ethereum RPC set, overlapping C2 inside one hosting provider, and consistent masquerading as netd_service ^[25][26].

Watch whether the Ethereum RPC providers named in the binary treat malicious ENS resolution as their problem, since five plaintext endpoints are the one takedown surface left in the open ^[7]. Watch ADB on 5555 reachable through residential proxy egress, because that path did not change when the scanner left ^[17][18]. And watch the loader: if propagation is now somebody else's product, the next Kimwolf-class payload may arrive by delivery chains that look nothing like this one ^[4].