Kimwolf: the botnet that hides its brain on the blockchain

A boring front door

Kimwolf does not use a clever exploit to get in. It looks for devices that expose the Android Debug Bridge on port 5555 with no authentication, a setting that ships enabled on a surprising number of cheap TV boxes and set-top devices. Reach the port, push the app, done. The whole first stage is a configuration failure, not a vulnerability.

The part worth studying

The interesting engineering is the command-and-control. Instead of a hard-coded server that defenders can sinkhole, Kimwolf resolves its controller through Ethereum name records, queried across five hard-coded RPC endpoints, with a Tor hidden service and a local proxy as fallbacks. Blockchain records are not something an incident responder can take down with an abuse report. The malware masks its process as netd_service and listens on localhost 23075. Once it has a foothold, the device joins a DDoS fleet with fifteen attack methods spanning OSI layers three to seven.

Why this is not just a consumer story

Two reasons it reaches the enterprise. First, shadow IT: a TV box in a meeting room or a reception screen sits on your network and nobody assessed it. Second, the pattern generalises. Unauthenticated management interfaces and takedown-resistant C2 are exactly what you will meet again on OT gear, cameras and building systems. Kimwolf is a clean illustration of a class.

Mitigations

• Disable ADB, or restrict it to USB, on any Android-based device.
• Segment TV boxes, screens and IoT away from the corporate network.
• Watch for blockchain RPC traffic (0xrpc.io, eth.llamarpc.com) and Tor SOCKS5 from IoT ranges.
• Treat any device with an open :5555 as compromised until proven otherwise.

What it means for your register

Kimwolf is a reminder that your attack surface includes the assets nobody wrote down. A device that is not in the inventory cannot be assessed, cannot be assigned an owner, and cannot be patched. This is why the asset referential and the business-impact assessment come before the risk assessment: the reception screen running an unpatched TV box is low criticality on confidentiality but sits on the same VLAN as something that is not. The risk is not the botnet. The risk is the asset you did not know you had.

Technical detail from Unit 42’s analysis at Palo Alto Networks Unit 42.