cyberscoop.com • 9h
Evolution of the Kimwolf AISURU Botnet: Decentralized Ethereum C2 and Android IoT Targeting
The Kimwolf (AISURU) botnet has transitioned to a highly resilient v7 architecture, specifically engineered to bypass law enforcement-led infrastructure takedowns. By shifting from centralized servers to a decentralized command-and-control (C2) model utilizing the Ethereum blockchain and Ethereum Name Service (ENS), the botnet achieves significant persistence against domain and IP seizures. Targeting the Android IoT ecosystem—primarily Android TV boxes—the malware leverages HTTP/2 protocol multiplexing and Chrome browser fingerprint mimicry to evade Web Application Firewalls (WAFs) and Layer 7 DDoS mitigation. This evolution enables massive volumetric attacks while maintaining high operational stealth within legitimate web traffic streams.