Kimwolf is an Android botnet variant of AISURU that has infected over 2 million devices through residential proxy networks. The botnet targets Android devices running exposed Android Debug Bridge (ADB) services, with 67% of infected devices being unauthenticated with ADB enabled by default. The malware turns infected systems into conduits for relaying malicious traffic and orchestrating DDoS attacks. The main payload listens on port 40860 and connects to 85.234.91[.]247:1337 for command and control. The botnet monetizes through app installs, selling residential proxy bandwidth, and DDoS functionality. Infections are concentrated in Vietnam, Brazil, India, and Saudi Arabia, with approximately 12 million unique IP addresses observed per week.