RESEARCHERS NULL-ROUTE OVER 550 KIMWOLF AND AISURU BOTNET COMMAND SERVERS

Summary from the TLDR InfoSec newsletter

Black Lotus Labs null-routed over 550 C2 nodes associated with the AISURU/Kimwolf botnet, which has infected more than 2 million Android devices—primarily unsanctioned TV streaming boxes with exposed Android Debug Bridge (ADB) services. The botnet exploits vulnerabilities in residential proxy services to propagate, turning compromised devices into proxy nodes for DDoS attacks and malicious traffic relay. Security teams should monitor for ADB exposure on network devices and block traffic to the identified C2 infrastructure.