MALWARE FAMILY

Kimwolf

Internal ID: apk.kimwolf

aliases

Last seen:Mar 17, 2026

Intelligence Profile

KIMWOLF is an android based malware which uses compromised systems to relay malicious and abusive Internet traffic, as well as participating in distributed denial-of-service (DDoS). KIMWOLF primarily infects unofficial Android-TV set-top boxes and digital photo frames. The malware has frequently been noted to achieve infection spread via abusing Android Debug Bridge (ADB) and residential proxies. There are multiple reports suggesting a connection to the Aisuru botnet, with Kimwolf acting as the Android variant.

Threat Analysis

Kimwolf is a malware family tracked by threat intelligence researchers and catalogued in the Malpedia dataset. It represents a distinct malicious software lineage with identifiable code characteristics, behaviors, and victimology.

External References

→http://blog.xlab.qianxin.com/kimwolf-botnet-en/

→https://blog.cloudflare.com/ddos-threat-report-2025-q4/

→https://krebsonsecurity.com/2026/01/kimwolf-botnet-lurking-in-corporate-govt-networks/

→https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/

→https://krebsonsecurity.com/2026/01/who-benefited-from-the-aisuru-and-kimwolf-botnets/

→https://krebsonsecurity.com/2026/01/who-operates-the-badbox-2-0-botnet/

→https://synthient.com/blog/a-broken-system-fueling-botnets

→https://www.infoblox.com/blog/threat-intelligence/kimwolf-howls-from-inside-the-enterprise/

→https://www.securityweek.com/kimwolf-android-botnet-grows-through-residential-proxy-networks/

Quick Facts

TypeMalware Family

Aliases1

Also Known As

apk.kimwolf

Research Links

MITRE ATT&CK VirusTotal Google (news) Twitter/X search

Data sourced from Malpedia, Ransomware.live, RansomLook, and CTIWATCH OSINT collection. Actor attribution is based on available intelligence and may be incomplete.

← All Threat Actors·Geopolitics Map·Search Kimwolf