Kimwolf Botnet Infects Over 2 Million Android Devices via Residential Proxies

The Kimwolf botnet has emerged as a significant cybersecurity threat, infecting over 2 million Android devices, primarily through residential proxy networks. This botnet, linked to the Aisuru botnet, has been active since at least August 2025 and has gained notoriety for its ability to execute large-scale distributed denial-of-service (DDoS) attacks. Cybersecurity firm Synthient has reported that Kimwolf exploits vulnerabilities in devices, particularly targeting Android TV boxes and other low-cost devices with exposed Android Debug Bridge (ADB) services.

Kimwolf Android Botnet Grows Through Residential Proxy NetworksKimwolf Android Botnet Infects Over 2 Million Devices via Exposed ADB and Proxy NetworksKimwolf botnet affects 2 million Android devicesKimwolf botnet leverages residential proxies to hijack 2M+ Android devicesRussia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025When 'Shiny Objects' trick 'Shiny Hunters'

Researchers from Synthient estimate that Kimwolf's rapid proliferation is largely due to its exploitation of unsecured residential proxy networks. Many of the compromised devices were sold pre-infected with malicious software that turns them into proxies. The botnet has been particularly successful in regions such as Vietnam, Brazil, India, and Saudi Arabia, with approximately 12 million unique IP addresses associated with it weekly. The botnet's architecture includes multiple command-and-control (C2) servers, making it challenging to track and mitigate.

Kimwolf Android Botnet Infects Over 2 Million Devices via Exposed ADB and Proxy NetworksKimwolf Android Botnet Grows Through Residential Proxy NetworksKimwolf botnet leverages residential proxies to hijack 2M+ Android devicesKimwolf botnet affects 2 million Android devicesRussia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025

Kimwolf not only conducts DDoS attacks but also monetizes its infections through various means. It installs third-party proxy SDKs, such as the Plainproxies Byteconnect SDK, which facilitates bandwidth resale and credential-stuffing attacks. Synthient's analysis indicates that the botnet operators earn revenue by selling residential proxy bandwidth at competitive rates, further incentivizing the exploitation of vulnerable devices.

Kimwolf botnet leverages residential proxies to hijack 2M+ Android devicesKimwolf Android Botnet Infects Over 2 Million Devices via Exposed ADB and Proxy NetworksKimwolf Android Botnet Grows Through Residential Proxy NetworksKimwolf botnet affects 2 million Android devicesRussia-linked APT UAC-0184 uses Viber to spy on Ukrainian military in 2025CC warns of critical, unfixed vulnerability in TOTOLINK EX200

In light of the growing threat posed by Kimwolf, Synthient has urged proxy providers to block risky ports and for users to check their devices for infections. Organizations are advised to monitor traffic and block connections to known C2 infrastructure. The cybersecurity community emphasizes the need for improved security measures across residential proxy networks to prevent further exploitation.

Kimwolf botnet leverages residential proxies to hijack 2M+ Android devices

Critics highlight that the Kimwolf botnet exemplifies systemic vulnerabilities within the residential proxy ecosystem. The rapid growth of this botnet underscores the risks associated with unsecured devices and the exploitation of the "gray market" of proxy services. The collaboration between threat actors and commercial proxy providers raises concerns about the broader implications for cybersecurity.

Kimwolf botnet leverages residential proxies to hijack 2M+ Android devices

While Synthient estimates that Kimwolf has infected over 2 million devices, some sources suggest that the actual number of infections could be significantly higher due to the botnet's ability to leverage numerous IP addresses and its rapid evolution. The exact scale of the botnet remains difficult to ascertain, as its infrastructure is designed to evade detection.

Kimwolf botnet leverages residential proxies to hijack 2M+ Android devices

• “Kimwolf’s rapid growth can be attributed to its targeting of vulnerable devices through its novel exploitation of residential proxy networks.” — Synthient Research Team

Kimwolf botnet leverages residential proxies to hijack 2M+ Android devices

• “The discovery of pre-infected TV boxes and the monetization of these bots through secondary SDKs like Byteconnect indicates a deepening relationship between threat actors and commercial proxy providers.” — Synthient Research Team

Kimwolf Android Botnet Infects Over 2 Million Devices via Exposed ADB and Proxy Networks

• “The scale of this vulnerability was unprecedented, exposing millions of devices to attacks,” — Synthient Research Team

Kimwolf Android Botnet Infects Over 2 Million Devices via Exposed ADB and Proxy Networks

The Kimwolf botnet represents a significant challenge in cybersecurity, highlighting the need for robust defenses against the exploitation of residential proxy networks and the vulnerabilities of connected devices.

Kimwolf Android Botnet Grows Through Residential Proxy Networks