Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

Back Thehackernews

Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

Thehackernews •[email protected] (The Hacker News) • August 11, 2026

Share: View original

AI can find and chain vulnerabilities in minutes. This session gives you a practical roadmap to strengthen visibility, response, and remediation.

AI is helping teams ship code 10–50× faster. This session shows how to keep security from falling behind.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kimwolf Botnet v7 Enhances DDoS Tactics Using Chrome Fingerprints and Ethereum The Kimwolf botnet, primarily composed of hijacked Android TV boxes, has been upgraded to version 7, which employs advanced techniques to disguise DDoS attack traffic as legitimate web browsing. Discovered by Palo Alto Networks' Unit 42, this version became active on February 3, 2026, and utilizes HTTP/2 to mimic Chrome browser behavior, making it harder for defenses to distinguish between legitimate and malicious traffic. Additionally, the botnet's command infrastructure now leverages the Ethereum Name Service to evade law enforcement takedowns, as it can dynamically change command addresses without being tied to a single domain. The command servers are believed to be located in Russia, complicating efforts to disrupt the botnet. This new iteration of Kimwolf poses a significant threat to online services, as it can overwhelm targets with traffic that appears genuine. 3 sources 71

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (2)