TLDR Tech / InfoSec
Kimwolf v7: An Evolution of the Kimwolf Botnet
Kimwolf v7 is an evolving IoT botnet that compromises Android TV boxes via unauthenticated ADB interfaces to launch HTTP/2 flood attacks using spoofed browser fingerprints. The malware utilizes a resilient, three-tier command-and-control architecture featuring Ethereum Name Service lookups, a hardcoded Tor hidden service fallback, and a localized proxy routing system. Defenders should restrict network ADB access, hunt for the masqueraded netd_service process, and monitor for anomalous outbound Ethereum RPC queries directed at the operator-controlled endpoint eth[.]rpcuniverse[.]com.
Read the full story