Steve Gibson (65:07)
They wrote on October 24, 2025. So a couple months back, a trusted partner in the security community provided us with a brand new botnet sample. The most distinctive feature of this sample was its command and control domain. And it's 14 em e e l I a that's 14 Emilia. Then we see the word terrace T E R R A C E then West Brockbury MA and then 02132. That's a street address of somebody. Dot Su is the command and control domain they. And get this, they wrote which at the time ranked. So that wacky domain name at the time ranked second in the Cloudflare domains ranking. A week later it even surpassed google.com to claim the number one spot in Cloudflare's global domain popularity rankings. They said there is no doubt that this is a hyperscale botnet. Based on the information output during runtime and its use of the Wolf SSL library. We have named it Kim Wolf. Okay, now just to clarify here, what they what they intend by citing Cloudflare's domain rankings is that Cloudflare tracks, ranks and reports the domain. The popularity of of the domains being used across the Internet. From their view, there are so many instances of this newly discovered botnet that it was briefly taking the number one slot globally in Cloud Flare's global rankings, pushing even Google down from its normally secure first slot ranking down into second place. So that is a lot of activity. Okay, so get a load of what they discovered about this massive newcomer, they wrote. Kim Wolf is a botnet compiled using the NDK that's Android's native developer kit. In addition to typical DDoS attack capabilities, it integrates proxy forwarding, remote reverse shell and file management functions. Okay, so it's, it's, it's a proxy meaning that other traffic can be routed through your smart TV and stuff appears to be coming from you. A reverse shell meaning they're able to, you know, talk, log into your Android instance running in your smart TV and file management, you know, load, save, you know, get files and so forth, they said. From an overall architectural perspective, its functional design is not complex, but there are some highlights worth noting. For example, the sample that they received uses a simple yet effective Stack XOR operation to encrypt sensitive data. Meanwhile, it utilizes the DNS over tls.protocol, which actually is built into Android. So that would make sense to encapsulate DNS requests to evade traditional security detection. Furthermore, its command and control identity authentication employs a digital signature protection mechanism based on elliptic curves. So the command and control is is the command and control system is now using elliptic curve digital signatures to to prevent anybody else from act from from from commandeering control of the botnet. Different world than we were than we used to be in they said where the bot side will only accept communication instructions after the signature verification passes. Recently it's introduced ether hiding technology to as an ether block Ether Ethereum ether hiding technology to counter takedowns using blockchain domains. These features are relatively rare in similar malware. Based on our so this is a sophisticated little bot. Based on our analysis results, it primarily targets Android platform TV boxes. The welcome to Android Support center message displayed on the command and control back end also corroborates this. The Kim Wolf samples use a naming rule to identify version numbers. The sample previously provided by our community partner was version four. After completing the reverse engineering analysis, we imported the samples intelligence into the XLabs and these are security researchers from XLAB into the XLABS Cyber Threat Insight and Analysis system, successively capturing multiple related samples including they got their own copies of V4 and also the next one V5, thus achieving automated continuous tracking of this family, meaning that now, now that they're in they, they will automatically be updated when, when the botnet system updates, they said. On November 30, we captured another new sample of this botnet family and successfully took over one of the C2, one of the command and control domains, thereby obtaining the opportunity to directly observe the true operating scale of this botnet for the first time. Based on statistics from source IP data that establish connections with our registered C2 address and whose communication communication behavior matched Kim Wolf command and control protocol characteristics, we observed a cumulative total of approximately 2.7 million distinct source IP addresses over the three days from December 3 through December 5. 2.7 million, they said. Among them, we observed approximately 1.36 million active IPs on December 3, 1.83 million on December 4, and 1.5 million on December 5, they said. There's an IP overlap between different dates. Analysis indicates that Kim Wolf's primary infection targets are TV boxes deployed in residential network environments. Since residential networks usually adopt dynamic IP allocation mechanisms, you know, Dhcp, the public IPs of devices change over time, so the true scale of infected devices cannot be accurately measured solely by the quantity of IPs. In other words, the cumulative observation of 2.7 million IP addresses does not equate to to 2.7 million infected devices. Despite this, we still have sufficient reason to believe that the actual number of devices infected by Kim Wolf exceeds 1.8 million. This judgment is based on observations in the following areas. First, Kim Wolf uses multiple command and control infrastructures. We took over only a portion of of the command and controls, so we could only observe the activity of some bots unable to cover the full picture of the botnet. Also, on December 4th, the number of bot IPs we observed reach approximately 1.83 million, a historical peak. On that day, parts of the command and control normally used by Kim Wolf were taken down by relevant organizations, causing a large number of bots to fail to connect to the original command and controls and, and in turn to try connecting to, to the C2 we preemptively registered. So that means that there's an algorithm, right? We've talked about this in years past. An algorithm by which the bots generate the domains which they'll be using, and it's possible to look into the future and, and register a domain before the bad guys get to it, and then wait there for the bots to, to generate that domain name and then start, you know, send out DNS queries for it and then start connecting to it by ip. So they said this anomalous event caused more bots to be centrally exposed in a short period, so the data for that day may be closer to the lower limit of the true infection scale, that being 1.83 million devices. They said infected devices are distributed across multiple global time zones affected by time zone differences and usage habits, for example turning off devices at night, not using TV boxes during holidays, etc. These devices are not online simultaneously, further increasing the difficulty of comprehensive observation through a single time window. And and finally, Kim Wolf exists in multiple different versions, and the command and controls used by different versions are not completely identical, which is also one of the important reasons why we cannot obtain a complete perspective. Combining the above factors, we conservatively estimate that the actual number of devices infected by Kim wolf has exceeded 1.8 million. A botnet of such scale possesses the capability to launch massive cyber attacks, and its potential destructive power cannot be ignored. While working hard to track new versions, we were also full of curiosity about the old versions through source tracing analysis. Although we failed to capture old versions like V1 and V2, we we surprisingly found that Kim Wolf is actually associated with the Asuru botnet. Kim Wolf relies on the APK file to load and start it during runtime. A Dex file uploaded to virus total VT from India on October 7 showed obvious homologous characteristics which with Kim Wolf's APK. Subsequently, on October 18, the parent APK of that DEX was uploaded to VirusTotal from Algeria. The resource files of this APK contain asuru samples for three CPU architectures x86, x84 and ARM. We speculate that in the early stages of this campaign, the attackers directly reused Isiru's code. Subsequently, likely because Isiru samples had high detection rates in security products, Android platforms have more maturity more mature security protection systems compared to IoT ecosystems. The group decided to redesign and develop the Kimwolf botnet to enhance stealth and evade detection. So this is an evolution, an outgrowth of what was previously the largest, most powerful botnet known, they said from the monitoring data of the XLAB command tracking system. Statistics show that the main functions of the Kim Wolf botnet are usually concentrated on traffic proxying with a small amount of DDoS attacks. However, between November 19th and 22nd it went suddenly crazy. In just three days it issued 1.7 billion DDoS attack commands, with the attack range covering massive amounts of IP addresses globally. This high profile spree follows on the heels of the command and control domain's unprecedented rise to the number one to number one spot in in global popularity. Theoretically, such a large number of attack commands and targets may not be able to produce substantial attack effects on the targets, Right, because they're too short lived. This behavior may have been purely to demonstrate its own presence. Currently, the security community's understanding of Kim Wolf presents a polarized situation. Information in the public intelligence field is scarce, its propagation path is not yet clear, and the detection rate of related samples and their command and control domains on VirusTotal is extremely low. At the same time, due to the adoption of COVID technologies like dot, the association between its command and control and samples has not been effectively discovered. However, at the non public threat confrontation level, the situation is entirely different. We observed that Kim Wolf's command and control domains have been successfully taken down by unknown parties at least three times, forcing it to upgrade its tactics and turn to using ENS Ethereum name service to harden its infrastructure, demonstrating its powerful evolutionary capability. Given that Kim Wolf has formed a massive attack scale and its recent activity frequency and attack behaviors show a significant upward trend, we believe it's necessary to break the intelligence silence. We hereby release this technical analysis report to make relevant research results fully public, aiming to promote threat intelligence sharing, gather community strength to jointly respond to such threats, and effectively maintain cyberspace security. Okay, now everyone has a good sense now for what's going on with this apparent descendant of the previously massive and famous Assuru botnet. So one question is where are these infected TV boxes? Who has them? Since these researchers were briefly in the position to be receiving incoming bot traffic to their Command and Control IP to the tune of 1.83 billion IPS. No, sorry, 1.83 million IPS they were able to obtain the bots demographics Infected devices are distributed across, well, pretty much everywhere. 222 countries. How many countries are there? So the top 15 countries are in order of most to last the top 15 Brazil is the highest percentage of infections in consumer TB TV boxes of Kim Wolf at nearly 15% of of this 1.83 million devices are in Brazil 14.63 India's number two at 12.71% and we proudly the USA at 9 and a half 9.58% so we're in third place. So we are. So we are one ju just shy of 1/10 of the total Kim Wolf botnet infestation percentage. Argentina at 7.19 South Africa 3.85 the Philippines 3.58 Mexico at 3 China also at 3 Thailand 2.46 Saudi Arabia 2.37 Indonesia 1.87, Morocco 1.85, Turkey 1.60, Iraq 1.53 and Pakistan at 1.39. So with all of the last bunch of those, Indonesia, Morocco, Turkey, Iraq, Pakistan at a little over 1% and this being the top 15 out of a total of 222 countries, obviously there's a huge, I mean there's a massive spread, but all the other countries are just minuscule populations. But Brazil number one, India number two, USA number three, and we've got just shy of 10%. So I'm going to share one more piece. From their extensive research, they wrote readers familiar with DDoS might be curious and they have a quote. For such a huge botnet, what level has its attack capability actually reached? Okay, so they said although we cannot directly measure it, through observations of two large scale ddos events and a horizontal comparison with Isuru, we believe Kim Wolf's attack capability is close to 30 terabits per second first, and they have, they have three factoids, they said first, a well known cloud service provider observed a 2.3 billion packets per second and remember, each packet is made out of many more bits. So 2.3 billion packets per second attack at 2209 Zulu on November 23rd with 450,000 participating IPS, they said we confirmed Kim Wolf's participation. Second, a well known cloud service provider observed an attack nearing 30 terabits per second and 2.9 gigapackets per second at 09:35 Zulu on December 9. After data comparison, both parties confirmed Kim Wolf's participation. And finally, Cloudflare pointed out its third quarter 2025 DDoS threat report that ISIRU was one of the strongest known botnets currently with a control scale of millions of IoT network devices capable of sustaining terabits per second, level of tax and even peaks approaching 30 terabits per second and more than 10 billion packets per second. So they said, in fact, we believe that behind many attacks observed by Cloudflare attributed to aciru, it may not just be the ISIRU botnet acting alone. Kim Wolf may also be participating or even led by Kim Wolf. These two major botnets propagated through the same infection scripts between September and November, coexisting in the same batch of devices. They actually belong to the same hacker group. Okay, now if 9.58% of Kim Wolf's infections have been seen in the U. S and if there are Conservatively more than 1.8 million operating instances of Kim Wolf, that's more than 172,000 172,000 Android based smart TVs currently infected with Kim Wolf just in the US these guys conclude their very thorough analysis and I've got a link to the original posting because there's a they did they did a complete reverse engineering of this bot, but they wrote this is the majority of the intelligence we currently possess on on the Kim Wolf botnet. Giant botnets originated with Mirai in 2016 with infection targets mainly concentrated on IoT devices like Home broadband routers and cameras. However, in recent years information on multiple million level giant botnets like Bad Box, Big Pansy, Vald and Kim Wolf has been disclosed indicating that some attackers have started to turn their attention to various smart TVs and TV boxes. These devices generally suffer from problems like firmware vulnerabilities, pre installed malicious components, yikes, weak passwords and lack of security update mechanisms making them extremely easy for attackers to control long term and use for large scale cyber attacks. One of our motives for disclosing the Kim Wolf botnet this time is to call on the security community to give due attention to smart TV related devices after attackers gain root privileges on smart TVs, the resulting attacks are not limited to traditional cyberspace Attackers can use controlled terminals to insert tampered, biased or extreme videos in the legal systems of many countries, inserting content without written permission violates the contract between the viewer and the TV program provider and is illegal. This is our second motive for disclosing the Kim Wolfbotn at this time, calling on law enforcement agencies to consider scrutinizing such suspected illegal activities related to smart TVs against the backdrop of overlapping threats. Whether ordinary TV boxes, sales channels, operators or regulatory departments and manufacturers, all must attack attach great importance to the security of TV boxes. Among them, TV box users should especially ensure devices come from reliable sources, use firmware that can be updated in time, avoid setting weak passwords and refuse to install APKs of unknown origin to reduce the risk of being infected and controlled by botnets. And remember social, you know social techniques for for penetrating trust are are going to be high up on the list of what attackers do. They said we sincerely welcome CERTs from all countries to contact us, share intelligence and vision, join hands to combat cybercrime crime and jointly maintain global cyber security. If you are interested in our research or have inside information, feel free to contact us via the X platform. So as I said, I placed a link to their entire analysis, most of which I skipped over because it's way more than what's needed here. But they they provide everything anyone knows to, to understand and identify Kim Wolf. So for anybody who wants to get a very clear look into the guts of the operation of a massively successful state of the art global botnet, you know, these guys have published that and I, I would heed their advice. I can't think of anything more, more useful and significant than, you know, you do not want this operating inside your smart tv. I have the feeling, Leo, that there are, there's a huge population of non mainstream top drawer TV boxes, you know, available.
