Kimwolf v7: The Android TV Botnet That Now Hides Its Traffic Behind Chrome Fingerprints and Ethereum Palo Alto Networks Unit 42 discovered Kimwolf v7 on February 3, 2026, while hunting threats following public disclosures of the botnet’s earlier activity. The new version substantially upgrades the DDoS capabilities and command infrastructure of a botnet that has been targeting Android TV boxes since August 2025, while its Linux counterpart AISURU has been active since mid-2024. The operators’ core objective hasn’t changed, build a large-scale DDoS platform, but the methods for sustaining it and hiding its traffic have become considerably more sophisticated. “This version upgrades its distributed denial-of-service (DDoS) attack capabilities and the resilience of its command-and-control (C2) infrastructure. Kimwolf primarily affects Android TV boxes and set-top boxes. Kimwolf v7 adds an HTTP/2-based DDoS flood that constructs complete browser fingerprints. This makes attack traffic more difficult to distinguish from legitimate browsing.” reads the report by Palo Alto Networks. “The threat’s binary includes five hard-coded public Ethereum-based endpoints for resolving Ethereum Name Service (ENS) domains. ENS is a blockchain-based naming system used to obtain C2 addresses.” The nghttp2 library powers the HTTP/2 flood and constructs headers that mirror legitimate Chrome browser behavior at the protocol level, making rate-limiting and fingerprint-based DDoS mitigation significantly harder. On top of that, the botnet uses Ethereum’s naming service to resolve its command server address, querying five legitimate public blockchain RPC endpoints shuffled randomly before each attempt, which means blocking any individual endpoint does almost nothing. “Kimwolf also carries a hard-coded Tor .onion hidden service as a backup and a local proxy architecture for flexible routing between clearnet and Tor.” continues the report. “The malware developers added this function to directly respond to C2 server takedown efforts in December 2025.” The three-tier structure, Ethereum ENS, then Tor hidden service, then local proxy on 127.0.0.1:23075, is a direct operational response to two takedowns the botnet suffered in December 2025. The local proxy routes all C2 traffic through the same local address regardless of whether it’s going to the clearnet or Tor, which means the proxy component can be updated independently without redeploying the main bot binary. Unit 42 also identified what it assesses with moderate confidence to be an operator-controlled RPC facade at eth.rpcuniverse.com, based on its single-tenant hosting, registration timing, and exclusive presence in Kimwolf samples. Kimwolf spreads by abusing residential proxy services to reach Android TV boxes that ship with Android Debug Bridge enabled on port 5555. Once tunneled into a local network through a proxy endpoint, attackers can install the malware without any authentication. The botnet masks itself as “netd_service” to blend in with legitimate Android system processes, and Unit 42 found eight APK packages distributed between October and December 2025 that masquerade as a system service called SystemService, probing for root access before executing a bundled kernel payload. Version 7 also strips out all scanning, exploitation, and brute-force functionality from the main binary — the operators have separated the propagation pipeline from the DDoS core. External loaders now handle initial access, while the Kimwolf binary handles attacks and acts as a relay. The attack method count was consolidated from 43 text-named commands in earlier versions to 15 numbered methods covering layers 3 through 7, including the new HTTP/2 flood, a high-performance UDP flood with ARM NEON SIMD acceleration optimized for the processors in Android TV boxes, and a TLS/HTTPS flood. Unit 42 clustered C2 infrastructure across 22 IP addresses in Saint Petersburg, Russia, all sharing the same SSH host key between December 2025 and February 2026. The defensive guidance from Unit 42 is straightforward: treat Android TV boxes as untrusted devices and segment them from enterprise networks. Disabling ADB or restricting it to USB-only access removes the primary way this botnet gets onto devices. For detection, watch for outbound HTTPS connections to Ethereum RPC endpoints from devices that normally have no business touching blockchain services, Tor circuit activity or SOCKS5 proxy traffic from TV boxes, connections to localhost port 23075, and any Android consumer device running a process named “netd_service.” “Kimwolf v7 is a focused evolution of an already large-scale botnet. The HTTP/2 flood with Chrome browser fingerprinting complicates application-layer DDoS mitigation, as attack traffic now mirrors legitimate browser behavior at the protocol and header level.” concludes the report. “The three-tier C2 system (Ethereum ENS, Tor .onion, local proxy) indicates that the operators are investing in infrastructure built to withstand takedown operations.” In March, the U.S. DoJ disrupted command-and-control infrastructure used by several IoT botnets, including AISURU, Kimwolf, JackSkid, and Mossad. The operation involved authorities from Canada and Germany, along with major tech companies, to target botnet operators and weaken their global cybercrime activities. The AISURU/Kimwolf botnet was linked to a record-breaking DDoS attack that peaked at 31.4 Tbps and lasted just 35 seconds. Cloudflare said the November 2025 incident was part of a surge in hyper-volumetric HTTP DDoS attacks observed in late 2025, all automatically detected and mitigated. Kimwolf is a newly discovered Android botnet linked to the Aisuru botnet that has infected over 1.8 million devices and issued more than 1.7 billion DDoS attack commands, according to XLab. The Kimwol Android botnet primarily targets TV boxes, compiled using the NDK and equipped with DDoS, proxy forwarding, reverse shell, and file management functions. It encrypts sensitive data with a simple Stack XOR, uses DNS over TLS to hide communication, and authenticates C2 commands with elliptic curve digital signatures. Recent versions even incorporate EtherHiding to resist takedowns via blockchain domains. Kimwolf follows a naming pattern of “niggabox + v[number]”; versions v4 and v5 have been tracked. By taking over one C2 domain, researchers observed around 2.7 million IPs interacting over three days, indicating a likely infection scale exceeding 1.8 million devices. Its infrastructure spans multiple C2s, global time zones, and versions, making it hard to estimate the total number of infections. The botnet borrows the code from the Aisuru family, however, operators redesigned it to evade detection. Its primary function is traffic proxying, though it can execute massive DDoS attacks, as seen in a three-day period issuing 1.7 billion commands between November 19 and 22. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Kimwolf v7)
Chaotic Eclipse released a PoC for ShieldBreak, a Microsoft Defender zero-day that bypasses the CVE-2026-50656 patch and could enable SYSTEM-level code execution. Security researcher Chaotic Eclipse, also known as INFINITE NIGHTMARE, MSNightmare and Nightmare-Eclipse, released a PoC for ShieldBreak, a Microsoft Defender zero-day. The flaw bypasses the patch for CVE-2026-50656 (RoguePlanet), a race condition that can allow attackers to spawn a SYSTEM-level shell. Successful exploitation could enable arbitrary code execution and other unauthorized actions on affected Windows systems. “Microsoft has failed to properly patch the RoguePlanet vulnerability CVE-2026-50656, this PoC demonstrates a full patch bypass.” said Chaotic Eclipse. “The PoC was tested in the latest version of windows 11 25h2 (+Canary channel) and windows server 2025, the PoC also have a 100% success rate. Please note that Windows 10 (and respective server editions) are not currently supported, they are however vulnerable to ShieldBreak as well.” In early July, Microsoft released security updates for RoguePlanet, a vulnerability tracked as CVE-2026-50656 (CVSS score of 7.8) affecting the Malware Protection Engine used by Defender. The Microsoft Malware Protection Engine (mpengine.dll) powers Defender’s malware scanning, detection, and removal functions. The flaw is a local privilege escalation issue that could allow an attacker with access to a system to obtain higher privileges and potentially compromise security controls. In mid-June, Microsoft acknowledged the RoguePlanet zero-day affecting Microsoft Defender and stated it is aware of the issue and was actively developing a security update to address the flaw and protect affected systems. A week before, the security researcher Chaotic Eclipse published a new proof-of-concept exploit for a RoguePlanet. The flaw relies on a race condition that can provide attackers with SYSTEM-level privileges, allowing them to execute code with the highest permissions. The exploit was successfully tested on fully updated Windows 10 and Windows 11 systems running the June 2026 Patch Tuesday updates, showing that patched systems may still be vulnerable. Now Chaotic Eclipse claims ShieldBreak fully bypasses Microsoft’s CVE-2026-50656 patch, while Defender may also leak 8 bytes of data under certain conditions. The researcher tested the PoC on Windows 11 25H2 and Windows Server 2025 with a 100% success rate. Windows 10 is also vulnerable, though not currently supported by the PoC. In May, the researcher disclosed two other Windows zero-day vulnerabilities named YellowKey and GreenPlasma. The flaws affect BitLocker and the Windows Collaborative Translation Framework (CTFMON). YellowKey could allow attackers to bypass BitLocker protections, while GreenPlasma enables privilege escalation. The researcher previously disclosed three Microsoft Defender vulnerabilities. The researcher criticized Microsoft for revoking access to their MSRC account, rejecting reports, and failing to provide compensation. At the end of May, Microsoft’s Security Response Center called the zero-day dumps irresponsible. “In recent weeks several zero-day vulnerabilities have been publicly disclosed.” reads the report published by Microsoft. “The details of these vulnerabilities were not shared with Microsoft prior to release, and the disclosures put our customers at unnecessary risk.” The company said its security teams have been working around the clock since the disclosures to understand the impact, build patches, and protect customers from attackers who picked up the published exploit code and ran with it. Microsoft’s post is essentially a public defense of Coordinated Vulnerability Disclosure, the standard practice where a researcher notifies a vendor privately, gives them time to fix the issue, and then goes public. Microsoft says it works with hundreds of researchers this way every year, compensating them through bug bounty programs and crediting them publicly. “This partnership allows us to make updates to impacted services before proof-of-concept code can make it into the hands of bad actors.” continues the report. “The vulnerabilities known as RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma were not responsibly disclosed.” The implication is clear: when someone skips that step, real people get attacked with real tools built from the published research. In July, just hours after Microsoft’s July 2026 Patch Tuesday, Chaotic Eclipse, published a new Windows zero-day proof-of-concept called LegacyHive. This time, the target is the Windows User Profile Service (ProfSvc), and unlike the hundreds of vulnerabilities Microsoft fixed this month, this one currently has no CVE, no advisory, and no security update. LegacyHive is a local privilege escalation vulnerability. An attacker who already has code execution as a standard user can abuse the User Profile Service to load another user’s registry hive, potentially that of a local administrator, under their own profile. At the end of May, Microsoft’s Security Response Center called the zero-day dumps irresponsible. “In recent weeks several zero-day vulnerabilities have been publicly disclosed.” reads the report published by Microsoft. “The details of these vulnerabilities were not shared with Microsoft prior to release, and the disclosures put our customers at unnecessary risk.” The company said its security teams have been working around the clock since the disclosures to understand the impact, build patches, and protect customers from attackers who picked up the published exploit code and ran with it. Microsoft’s post is essentially a public defense of Coordinated Vulnerability Disclosure, the standard practice where a researcher notifies a vendor privately, gives them time to fix the issue, and then goes public. Microsoft says it works with hundreds of researchers this way every year, compensating them through bug bounty programs and crediting them publicly. “This partnership allows us to make updates to impacted services before proof-of-concept code can make it into the hands of bad actors.” continues the report. “The vulnerabilities known as RedSun, UnDefend, BlueHammer, YellowKey, GreenPlasma, and MiniPlasma were not responsibly disclosed.” The implication is clear: when someone skips that step, real people get attacked with real tools built from the published research. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, ShieldBreak)
Microsoft Patch Tuesday for August 2026 fixes 398 CVEs, including an actively exploited zero-day and a wormable DNS flaw enabling remote code execution. Microsoft released its Patch Tuesday security updates for August 2026 on Tuesday, covering 398 new CVEs across Windows, Office, Azure, Exchange Server, SharePoint, Teams, GitHub Copilot, .NET, and a range of other components. Sixty-two are rated Critical. One is already being exploited in the wild. The good news, such as it is, is that the ratio of bugs being reported to bugs being actively exploited hasn’t moved — there’s no equivalent surge in zero-day exploitation to match the volume of fixes. The actively exploited bug is CVE-2026-68820, a use-after-free flaw in afd.sys, the kernel-mode driver that underpins the Windows Sockets API. CVE-2026-68820 is a Windows WinSock driver flaw that can let attackers execute code with SYSTEM-level privileges. Microsoft says it is actively exploited, although its CVSS assessment lists exploit maturity as “Unproven.” “Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.” reads the advisory. “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.” The DNS bug, tracked as CVE-2026-62878, deserves immediate attention. CVE-2026-62878 is a critical Windows DNS Server flaw that allows remote, unauthenticated attackers to execute code with elevated privileges without user interaction. The stack-based buffer overflow could be wormable, making rapid patching especially important for internet-facing DNS servers. “An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network.” reads the advisory. “Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.” A wormable remote code execution flaw with no authentication requirement on a service that’s almost universally exposed is exactly the kind of thing that turns into a widespread incident if patching lags. Three other remote code execution bugs round out the urgent list. CVE-2026-62893 hits Windows Deployment Services TFTP server, TFTP has no authentication, runs on UDP port 69, and any WDS server doing PXE boot is exposed. CVE-2026-62815 is in Microsoft’s QUIC implementation, the transport protocol underlying HTTP/3, and affects roughly 13.5 million websites. CVE-2026-59124 is a CVSS 9.8 flaw in Microsoft HPC Pack that Microsoft itself rates as “exploitation more likely”, the Important severity rating reflects that HPC isn’t on by default, not that the bug is less dangerous. The Exchange bug, CVE-2026-62911, is an elevation of privilege flaw via authentication bypass that was demonstrated with working code at Pwn2Own Berlin. If exploited successfully, an attacker can take over all mailboxes on the Exchange server — reading, sending, and downloading attachments across every user account. Microsoft’s exploitability ratings here are worth ignoring in favor of the Pwn2Own context: functional exploit code exists and was handed to Microsoft directly. Two publicly disclosed bugs — CVE-2026-62832 in Windows User Profile Service and CVE-2026-72971 in the Container Isolation FS Filter Driver — are also in this release, with the User Profile Service flaw considered likely to see exploitation. The August updates also fix two CVEs in the TPM 2.0 reference implementation, one spoofing and one information disclosure. The full list of CVEs addressed by Microsoft Patch Tuesday security updates for August 2026 is available here. Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini (SecurityAffairs – hacking, Microsoft Patch Tuesday)
Google says Chrome's anti-abuse systems reduced unwanted notifications on Android by more than 7 billion per day during the first quarter of 2026. In a new blog post, Google argues that notification abuse has increasingly been used to distribute scams, malware, phishing attempts, and fraudulent payment requests. To reduce the abuse, Google developed a "Swiss cheese" defense model, where several overlapping systems try to stop abuse at different stages. "Our goal is to ensure that if abuse slips through one layer, another is there to catch it," Google explained. "This approach allows us to halt abuse at the source, preventing deceptive content from reaching users while maintaining a healthy balance between utility and security." Chrome already removes notification permissions from inactive websites, as well as sites that repeatedly trigger suspicious-notification warnings.
The DeadLock ransomware operation is using a decentralized infrastructure that relies on blockchain-backed services to protect its communication with victims and data-leak activity. The threat actor emerged in mid-2025 and uses double-extortion tactics (data theft/leak and file encryption) to pressure victims into paying a ransom. By July this year, DeadLock's data leak site listed 80 organizations, mostly from Europe. Victims include companies in the IT, mining, transportation, manufacturing, hospitality, and consumer goods sectors. Microsoft researchers observed the malware being deployed by multiple groups, including an affiliate previously linked to the Lynx and INC ransomware ecosystems. The DeadLock ransomware operators adopted a new approach that uses the Polygon blockchain to store configuration data and the posts on the leak site.
Hackers associated with the Russian threat group Sandworm have been targeting system administrators and IT professionals through fake job offers since at least May. A report from the Ukrainian Computer Emergency Response Team (CERT) details a social engineering campaign attributed to UAC-0145, which is believed to be a sub-cluster of Sandworm (APT44). In the campaign, the threat actor targets victims while posing as IT companies and recruiters. The agency says that the attacker studies the targets' resumes uploaded on job sites and then initiates direct contact. Conversations are then moved to Telegram to arrange a video interview over Zoom. During the interview, which is conducted in English, the candidates receive mock technical assignments that require them to connect to a corporate VPN. In one case that CERT-UA observed, the attacker impersonated the international IT firm Sopra Steria using seemingly legitimate email addresses similar to the company’s office in Bulgaria.
Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in a core Windows kernel driver that handles network socket operations. An attacker with code already running on a machine can use it to escalate to SYSTEM. That patch goes out first. The flaw is tracked as CVE-2026-68820 (CVSS score: 7.0) and is the only
Microsoft released its monthly security updates on Tuesday, and one of the flaws it closed is already being used in attacks. The bug sits in a core Windows kernel driver that handles network socket operations. An attacker with code already running on a machine can use it to escalate to SYSTEM. That patch goes out first. The flaw is tracked as CVE-2026-68820 (CVSS score: 7.0) and is the only one in this month's release Microsoft flags as under active exploitation. Exploitation depends on triggering a race condition in the driver. Microsoft has not publicly attributed the exploitation. Check Point Research says Lazarus used the zero-day in its Operation Dream Job campaign. Four other flaws in the release need nothing at all from the victim: no account, no password, no click. They affect Windows DNS Server, Windows Deployment Services, Microsoft's implementation of the QUIC transport protocol, and High Performance Computing (HPC) Pack, and each carries a CVSS score of 9.8. None was flagged as exploited when the updates shipped.
Cisco is warning that a high-severity denial-of-service vulnerability in Secure Firewall ASA and Threat Defense (FTD) software is being actively exploited in attacks to remotely crash affected devices. The flaw, tracked as CVE-2026-20349, has a severity score of 8.6 and impacts devices running Cisco Secure Firewall Adaptive Security Appliance (ASA) or Secure Firewall Threat Defense (FTD) software with certain remote access services enabled. In a security advisory published today, Cisco said the vulnerability is caused by insufficient error checking while processing HTTP requests. "An attacker could exploit this vulnerability by sending a crafted HTTP request to the Remote Access SSL VPN service on an affected device," Cisco explains in the advisory. "A successful exploit could allow the attacker to cause the affected device to reload, resulting in a DoS condition."
Cybersecurity researchers have discovered a new version of the Kimwolf/AISURU Android and Internet of Things (IoT) botnet that comes with significant improvements to improve its operational resilience and conduct distributed denial-of-service (DDoS) attacks. The new version, tracked as Kimwolf v7, was discovered by Palo Alto Networks Unit 42 in February 2026. "Kimwolf v7 adds an HTTP/2-based
Confirm this action.
Leaving now will discard your changes.