Reported by 4 outlets

Timeline

1. update from unit42.paloaltonetworks.com

   Kimwolf v7: An Evolution of the Kimwolf Botnet

   unit42.paloaltonetworks.com · 63d ago · August 11th, 2026

   Discover how Kimwolf v7 targets Android IoT devices with HTTP/2 DDoS fingerprinting, Ethereum ENS C2 resolution and Tor backup routing. The post Kimwolf v7: An Evolution of the Kimwolf Botnet appeared first on Unit 42 .

2. update from cyberscoop.com

   Kimwolf botnet rebuilt to survive takedowns, researchers say

   cyberscoop.com · 63d ago · August 12th, 2026

   The developers of a notorious botnet that’s powered mostly by hijacked Android TV boxes and other internet-connected devices have released a new version built to blend attack traffic in with ordinary web browsing and to keep its command channels from being seized by law enforcement, researchers at Palo Alto Networks said in a report published Tuesday . The company’s Unit 42 threat intelligence group, which tracks the botnet as Kimwolf or Aisuru, said the newest version has been active since February, a month before authorities seized infrastructure powering previous versions of the botnet. The biggest change, according to the report, is a new flood method built on HTTP/2, the protocol that carries most web traffic today. A flood is the crude heart of a DDoS attack: thousands of infected devices send a target far more requests than it can answer. Rather than fire raw packets, this latest Kimwolf version operates with full browser fingerprints, copying the header order and behavior of the Chrome web browser. That matters because the usual defense against a flood is for tools to spot the fake traffic and drop or block it before it reaches the server. Traffic that looks like Chrome does not get dropped, so a site under attack must either serve every request and fall over, or start turning away the customers it cannot tell apart from the bots. The second change, according to researchers, looks like it was done to withstand further takedowns. Every bot has to ask a command server f

3. update from gbhackers.com

   Kimwolf v7 Removes Exploitation Code and Leaves Infection to External Loaders

   gbhackers.com · 61d ago · August 13th, 2026

   A newly identified Kimwolf v7 build shows the Android and IoT botnet shifting from an all-in-one compromise toolkit into a more specialized DDoS and proxy-relay payload. The latest variant removes embedded scanning, exploitation and brute-force logic, suggesting its operators now depend on external loaders to obtain access to vulnerable devices before deploying the bot. Unit […] The post Kimwolf v7 Removes Exploitation Code and Leaves Infection to External Loaders appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

4. update from cyberpress.org

   Chrome Fingerprint Spoofing Makes Kimwolf HTTP/2 Floods Harder to Separate From Real Users

   cyberpress.org · 61d ago · August 13th, 2026

   A newly identified version of the Kimwolf botnet is making distributed denial-of-service attacks harder to detect by making malicious traffic look like ordinary Chrome browser activity. Known as Kimwolf v7, the Android and IoT malware adds an HTTP/2 flood capability that builds browser-like request fingerprints, making it more difficult for defenders to separate attack traffic from real users. Kimwolf mainly targets Android TV boxes and set-top boxes. It is linked to the wider AISURU botnet operation, which initially focused on Linux IoT devices in 2024 before shifting toward Android-based targets in 2025. Researchers identified the v7 variant on February 3, 2026, following public reporting from several security organizations. The latest build focuses less on spreading and more on staying online and launching more effective DDoS attacks . It removes earlier scanner, exploit and brute-force components, suggesting that separate tools or loaders now handle initial infection while Kimwolf runs the botnet’s attack and command functions. Unlike basic request floods, this method creates a fuller set of browser headers designed to resemble Chrome traffic . This can make automated filtering more challenging because the malicious requests may look similar to normal browser sessions at the protocol and header level. Fingerprint header construction in build_http2_attack_header