Researchers Null-Route Over 550 Kimwolf and Aisuru Botnet Command Servers

"The Black Lotus Labs team at Lumen Technologies said it null-routed traffic to more than 550 command-and-control (C2) nodes associated with the AISURU/Kimwolf botnet since early October 2025. AISURU and its Android counterpart, Kimwolf, have emerged as some of the biggest botnets in recent times, capable of directing enslaved devices to participate in distributed denial-of-service (DDoS) attacks and relay malicious traffic for residential proxy services."

"The net result is that the botnet has expanded to infect more than 2 million Android devices with an exposed Android Debug Bridge (ADB) service by tunneling through residential proxy networks, thereby allowing the threat actors to compromise a wide swath of TV boxes. A subsequent report from Synthient has revealed Kimwolf actors attempting to offload proxy bandwidth in exchange for upfront cash."

"Black Lotus Labs said it identified in September 2025 a group of residential SSH connections originating from multiple Canadian IP addresses based on its analysis of backend C2 for Aisuru at 65.108.5[.]46, with the IP addresses using SSH to access 194.46.59[.]169, which proxy-sdk.14emeliaterracewestroxburyma02132[.]su. It's worth noting that the second-level domain surpassed Google in Cloudflare's list of top 100 domains in November 2025, prompting the web infrastructure company to scrub it from the list."

Black Lotus Labs null-routed traffic to more than 550 command-and-control nodes linked to the AISURU/Kimwolf botnet beginning in early October 2025. AISURU and Kimwolf can direct compromised devices to perform DDoS attacks and relay malicious traffic as residential proxies. Kimwolf infects mostly unsanctioned Android TV streaming devices by delivering a ByteConnect SDK via sketchy or pre-installed apps, exposing Android Debug Bridge (ADB) services. The botnet has grown to more than two million exposed Android devices. Synthient reported actors attempting to sell proxy bandwidth for cash. Investigators also traced residential SSH connections and identified C2 domains tied to hosting providers.

Read at The Hacker News