Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
- ID
- 13267
- Status
- summarized
- Published
- 12 Aug 2026, 3:36 AM
- Fetched
- 12 Aug 2026, 4:55 AM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/kimwolf-v7-android-botnet-makes-http2.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.5
- Created
- 12 Aug 2026, 5:01 AM
- Tags
- Audience
- developerssaas_founders
What happened
Palo Alto Networks Unit 42 discovered Kimwolf v7, an Android/IoT botnet variant active since mid-2024 that now uses HTTP/2 flood attacks with complete browser fingerprints via the nghttp2 library, making DDoS traffic indistinguishable from legitimate browsing. The botnet targets Android TV boxes with ADB enabled on port 5555, uses Ethereum Name Service (ENS) and Tor .onion for resilient C2, and has split propagation into a separate external loader while the core binary handles DDoS and proxy relay.
Why it matters
If you run web-facing services behind HTTP/2, this botnet's browser-fingerprint construction means traditional DDoS mitigation that inspects header patterns or rate-limits by request signature will struggle to separate attack traffic from real users. Builders should check whether their WAF or CDN provider has specific HTTP/2 flood detection that goes beyond header heuristics, and ensure any Android TV/IoT devices on their networks don't expose ADB on port 5555.
Discussion angle
How HTTP/2 browser-fingerprint spoofing changes the calculus for DDoS protection — and whether your current CDN/WAF stack would actually catch traffic that mirrors legitimate browser behavior at the protocol level.