Kimwolf Botnet Hijacks 1.8 Million Android TVs, Launches Large-Scale DDoS Attacks

Kimwolf is a DDoS botnet compiled using Android NDK that has infected 1.8 million Android-based TVs, set-top boxes, and tablets. The botnet issued 1.7 billion DDoS attack commands within three days (November 19-22, 2025). It integrates DDoS capabilities, proxy forwarding, reverse shell, and file management functions. Recent versions use EtherHiding technique with ENS domain 'pawsatyou[.]eth' to fetch C2 IP from smart contract. The malware supports 13 DDoS attack methods over UDP, TCP, and ICMP, uses TLS encryption for network communications, and deploys a Rust-based Command Client module for proxy services. Over 96% of commands relate to proxy services for bandwidth exploitation.