Indicators of compromise · Kimwolf — 4 shown
157[.]245[.]76[.]251:25001164[.]92[.]152[.]141:25001167[.]172[.]32[.]113:25001167[.]172[.]45[.]217:25001
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing
Palo Alto Networks Unit 42's analysis of the evolving Kimwolf Android botnet's v7 shows it using HTTP/2-based DDoS that mimics legitimate browser traffic to evade detection and filtering.
Summary
The Kimwolf Android botnet — in its v7 iteration — uses HTTP/2-based DDoS that mimics legitimate browser traffic to evade detection and filtering, advancing the family's stealth and amplification capability. The research is the primary analysis of a live threat and predates general press coverage. The research was published by Unit 42 (2026-08-11).
Date
- Published: 2026-08-11
Source
- Unit 42 — 2026-08-11