KIMWOLF V7: AN EVOLUTION OF THE KIMWOLF BOTNET

Summary from the TLDR InfoSec newsletter

Kimwolf v7 is an evolving IoT botnet that compromises Android TV boxes via unauthenticated ADB interfaces to launch HTTP/2 flood attacks using spoofed browser fingerprints. The malware utilizes a resilient, three-tier command-and-control architecture featuring Ethereum Name Service lookups, a hardcoded Tor hidden service fallback, and a localized proxy routing system. Defenders should restrict network ADB access, hunt for the masqueraded ⁠netd_service⁠ process, and monitor for anomalous outbound Ethereum RPC queries directed at the operator-controlled endpoint ⁠eth[.]rpcuniverse[.]com⁠.