Palo Alto Networks Unit 42 Uncovers Kimwolf v7 Botnet Infecting Android Set-Top Boxes via Open ADB

Specialists from Palo Alto Networks Unit 42 have discovered Kimwolf v7, a new version of a botnet that infects Android set-top boxes and other IoT devices. The malware now mimics real browser behavior during DDoS attacks and hides its command infrastructure behind multiple layers of protection.

The main innovation is HTTP/2 flooding that uses full browser fingerprints. The malicious code reproduces characteristic protocol parameters and headers, making it significantly harder to distinguish attack traffic from actions of ordinary visitors. Instead of simply overwhelming a site with requests, the botnet carefully impersonates a crowd of legitimate users.

Developers have also strengthened communication with command servers. Kimwolf v7 obtains their addresses through Ethereum Name Service and public Ethereum RPC services. If this channel fails, a reserve address in the Tor network is hardcoded into the binary. All traffic passes through a local proxy that handles both regular internet and Tor connections equally.

The new version removes scanning, vulnerability exploitation, and password brute-forcing functions. Researchers believe operators have split responsibilities: an external loader handles infection, while Kimwolf focuses on DDoS attacks and traffic forwarding. Instead of the previous 43 commands, the botnet now uses 15 numbered methods, including a high-performance UDP flood optimized for ARM processors in Android set-top boxes.

Kimwolf has been attacking such devices at least since August 2025. Operators typically reach set-top boxes with open Android Debug Bridge on port 5555 through residential proxies. After launch, the malware disguises itself as system processes such as netd_service. Researchers also found APK files named SystemService that check for root access and execute an embedded ELF payload.

Unit 42 recommends treating Android set-top boxes as untrusted devices, isolating them from corporate networks, and disabling ADB or restricting access to USB only. An inexpensive box connected to a television can easily become a costly problem for the entire infrastructure.