Story perspectives

Kimwolf Botnet Infects 2 Million Android Devices, Launches Massive DDoS Attacks

1/7/2026

Summary

Story summary

The Kimwolf botnet has infected over 2 million Android devices, according to Synthient.
The botnet has been active since at least August 2025 and targets low-cost Android TV boxes with unsecured Android Debug Bridge connections.
The botnet has been linked to massive DDoS attacks, with peaks reaching 29.7 Tbps.
Many devices were reportedly sold pre-infected with malware.
The operators monetize infections through app installations and proxy bandwidth sales.

1 of 1

Story summary

The Kimwolf botnet has infected over 2 million Android devices, according to Synthient.
The botnet has been active since at least August 2025 and targets low-cost Android TV boxes with unsecured Android Debug Bridge connections.
The botnet has been linked to massive DDoS attacks, with peaks reaching 29.7 Tbps.
Many devices were reportedly sold pre-infected with malware.
The operators monetize infections through app installations and proxy bandwidth sales.