THE KIMWOLF BOTNET IS STALKING YOUR LOCAL NETWORK

Summary from the TLDR InfoSec newsletter

The Kimwolf botnet infected over 2 million devices worldwide by using residential proxy networks (mainly IPIDEA) to bypass firewalls and directly access devices on internal networks. Two-thirds of these infections came from unsanctioned Android TV boxes sold on major e-commerce platforms, which ship with Android Debug Bridge mode enabled by default. RIT researcher Benjamin Brundage found that attackers exploited a vulnerability allowing DNS records to point to RFC-1918 internal addresses, bypassing domain restrictions and deploying malware on devices behind routers once thought to be secure. In response, IPIDEA released security patches to block internal network access and high-risk ports after receiving Brundage's December 2025 vulnerability report. Users should remove vulnerable Android TV boxes, set up guest Wi-Fi for visitors, and understand that traditional LAN security measures are now dangerously outdated.