Kimwolf Android botnet passes two million devices

The Kimwolf botnet, discovered in late October 2025, has passed two million infected devices according to researchers at Synthient. It mainly infects TV streaming devices through residential proxies, with unauthenticated ADB services reachable via those proxies as the primary infection vector. Such boxes are often sold in an unsecured state and run outdated software. Kimwolf is the Android implementation of the IoT botnet Aisuru, responsible for several large-scale denial-of-service attacks in 2025, and also includes a reverse shell and traffic proxy functionality.

What this means for your organisation

The devices in question typically sit in people's homes, not in the company server room. That has two consequences. First, such devices may share a network with employees working from home. Second, the proxy functionality means attack traffic arrives from ordinary residential addresses, making it harder to separate malicious requests from genuine customers. The attack capacity of a botnet this size is considerable.

Berigo recommends

• Ensure remote work goes through company-managed devices and VPN, not directly from the home network.
• Do not base filtering solely on whether traffic originates from a residential address or a data centre.
• Include high-capacity denial-of-service attacks in the contingency plan, and clarify who can trigger mitigation outside working hours.
• Give staff simple advice not to connect unsecured media boxes to the same network as work equipment.

Source

• synthient.com