Massive Kimwolf botnet targets Android devices

Newly emergent Kimwolf botnet has already compromised at least 1.8 million Android devices worldwide, with its command-and-control server site surpassing Google on website charts in late October, suggesting the possibility of widespread distributed denial-of-service intrusions, Cybernews reports.

Android TV boxes without Google Play Protect have made up most of the massive Kimwolf botnet, which not only facilitates DDoS but also proxy forwarding, file management, arbitrary command execution, and additional payload delivery, according to Xlab researchers. The U.S. had the third-highest volume of affected Android devices, following Brazil and India.

Further analysis of Kimwolf showed an association with Aisuru, with the known immense botnet's code believed to have been reused in the earlier stages of the attack campaign before its operators overhauled its detection evasion features to include EtherHiding technology. Kimwolf, which is being taken down by Xlab researchers, was also noted to have been particularly targeting cybersecurity investigative journalist Brian Krebs.