Evolution of the Kimwolf AISURU Botnet: Decentralized Ethereum C2 and Android IoT Targeting
The Kimwolf (AISURU) botnet has transitioned to a highly resilient v7 architecture, specifically engineered to bypass law enforcement-led infrastructure takedowns. By shifting from centralized servers to a decentralized command-and-control (C2) model utilizing the Ethereum blockchain and Ethereum Name Service (ENS), the botnet achieves significant persistence against domain and IP seizures. Targeting the Android IoT ecosystem—primarily Android TV boxes—the malware leverages HTTP/2 protocol multiplexing and Chrome browser fingerprint mimicry to evade Web Application Firewalls (WAFs) and Layer 7 DDoS mitigation. This evolution enables massive volumetric attacks while maintaining high operational stealth within legitimate web traffic streams.
Kimwolf IoT Botnet: Dismantling of the AISURU-based DDoS-for-Hire Infrastructure
An international law enforcement operation, spearheaded by the U.S. Department of Justice and Canadian authorities, has dismantled the Kimwolf IoT botnet and its associated DDoS-for-hire ecosystem. The botnet, operated by Jacob Butler (alias 'Dort'), utilized the AISURU malware strain to weaponize millions of vulnerable, internet-exposed IoT devices. The infrastructure facilitated massive volumetric attacks, reaching unprecedented peaks of 31.4 Tbps, and was managed through 45 seized web-based command platforms. By seizing the Command and Control (C2) infrastructure and over 25,000 attack command logs, this operation effectively neutralized a major segment of the global 'booter' market and mitigated systemic threats to global internet stability.