{ "hunt": { "meta": { "tlp": "clear", "hunt": { "handoff": "promote-to-detection", "trigger": "intel-report", "methodology": "model-assisted", "applicability": "campaign-specific", "justification": "Kimwolf v7 weaponizes Android IoT devices for large-scale DDoS; detecting initial propagation and masquerading prevents the environment from being used as botnet infrastructure." }, "name": "Kimwolf ADB Propagation and Evasion", "type": "investigation", "labels": [ "hunt", "attack.t1190", "attack.t1059", "attack.t1036.005" ], "series": { "slug": "kimwolf-v7-an-evolution-of-the-kimwolf-botnet", "index": 1, "title": "Kimwolf v7: An Evolution of the Kimwolf Botnet", "total": 2 }, "related": [ { "hunt": "kimwolf-infrastructure-ens-routing", "reason": "This hunt focuses on access and endpoint evasion; blockchain-based C2 resolution and Tor routing are handled in a separate infrastructure hunt.", "relation": "out-of-scope-alternative" } ], "targets": { "hunter": { "name": "Hunt agent", "agent": true }, "analyst": { "name": "Tier-2 analyst", "role": "analyst" }, "network": { "name": "Network telemetry", "category": "network", "telemetry": [ "network" ] }, "endpoint": { "name": "Endpoint telemetry (hb_ surfaces)", "category": "endpoint", "telemetry": [ "endpoint" ] } }, "analysis": "A standard rule for port 5555 triggers on legitimate developer activity; this hunt uses a gated agent-led flow to validate network leads against endpoint file drops and rare process masquerading.", "coverage": [ { "stage": "initial-access-adb-misuse", "steps": [ "lead-adb-connections" ], "status": "covered" }, { "stage": "execution-malware-installation", "steps": [ "malware-file-drops" ], "status": "covered" }, { "stage": "defense-evasion-process-masquerading", "steps": [ "masqueraded-processes" ], "status": "covered" }, { "stage": "c2-ens-resolution", "reason": "Belongs to another part of the 'Kimwolf v7: An Evolution of the Kimwolf Botnet' series.", "status": "out_of_scope" }, { "stage": "c2-local-proxy-routing", "reason": "Belongs to another part of the 'Kimwolf v7: An Evolution of the Kimwolf Botnet' series.", "status": "out_of_scope" }, { "stage": "impact-ddos-flooding", "reason": "Belongs to another part of the 'Kimwolf v7: An Evolution of the Kimwolf Botnet' series.", "status": "out_of_scope" } ], "scenario": { "stages": [ { "name": "Unauthenticated ADB Access", "slug": "initial-access-adb-misuse", "tactic": "initial-access", "techniques": [ "T1190" ], "observables": [ "Inbound connections to TCP port 5555 (Android Debug Bridge)", "Use of residential proxy services to tunnel into local networks" ] }, { "name": "Malware Installation via ADB", "slug": "execution-malware-installation", "tactic": "execution", "techniques": [ "T1059" ], "observables": [ "Installation of ELF binaries on Android devices", "Dropped files named libdevice.so or libn[redacted]kernel.so" ] }, { "name": "Process Name Masquerading", "slug": "defense-evasion-process-masquerading", "tactic": "defense-evasion", "techniques": [ "T1036.005" ], "observables": [ "Process name masked as netd_service", "Stripped ELF binaries compiled with Android NDK", "Creation of Unix domain socket beginning with @n[redacted]boxv7" ] }, { "name": "ENS C2 Resolution", "slug": "c2-ens-resolution", "tactic": "command-and-control", "techniques": [ "T1102.003" ], "observables": [ "Outbound traffic to 0xrpc.io", "Outbound traffic to eth.llamarpc.com", "Outbound traffic to ethereum-rpc.publicnode.com", "Outbound traffic to eth-protect.rpc.blxrbdn.com", "Outbound traffic to eth.merkle.io", "Outbound traffic to eth.rpcuniverse.com", "DNS queries for ENS C2 domains" ] }, { "name": "Local Proxy Architecture", "slug": "c2-local-proxy-routing", "tactic": "command-and-control", "techniques": [ "T1090" ], "observables": [ "Local network listener on 127.0.0.1:23075", "Connections to v3 Tor .onion address: edctgwib2n5l34t525zkxqzk5bqb6e5il2yiq5r6zu7gtlxa4uosn3qd.onion", "Direct C2 connections to 212.193.31.119, 212.193.31.122 (port 13)", "Direct C2 connections to 212.193.31.92, 212.193.31.158 (port 443)" ] }, { "name": "DDoS Flood Activities", "slug": "impact-ddos-flooding", "tactic": "impact", "techniques": [ "T1498.001" ], "observables": [ "HTTP/2 floods with Chrome browser fingerprints", "High-performance UDP floods using ARM NEON SIMD optimizations", "TCP SYN, ACK, and RST floods", "DNS query floods", "ICMP floods" ] } ], "summary": "Kimwolf v7 is an evolution of an Android IoT botnet that targets unauthenticated ADB interfaces on port 5555 for initial access. The malware employs highly resilient command-and-control infrastructure using Ethereum Name Service (ENS) for resolution and Tor as a backup, ultimately performing optimized DDoS floods including stealthy HTTP/2 browser fingerprinting." }, "severity": "high", "rationale": "Start with servers and unmanaged IoT segments. While the v7 variant targets Android, the AISURU codebase targets Linux IoT; scoping should include both platforms if unauthenticated port 5555 is exposed.", "guardrails": { "claims": "no_unsupported", "evidence": "citation_required", "telemetry": "untrusted", "missing_data": "not_benign" }, "hypothesis": "An intruder exploits unauthenticated ADB services on port 5555 to drop ELF binaries and masquerades as the netd_service system process to avoid detection on Android IoT devices.", "parameters": { "adb_port": { "type": "number", "default": "5555", "description": "The standard port for unauthenticated ADB access." }, "scope_hosts": { "type": "list[host]", "default": [], "description": "Optional list of hosts identified in the lead step to narrow forensics." }, "lookback_days": { "type": "number", "default": "14", "description": "Days of history to examine." }, "malware_filenames": { "from": { "ref": "unit42-kimwolf-v7", "kind": "article", "observed": "2026-08-11" }, "type": "list[string]", "default": [ "libdevice.so", "kernel.so" ], "description": "Filenames observed in Kimwolf v7 payloads." } }, "provenance": { "authors": [ { "org": "huntbase.io", "name": "Huntbase hunt generation" } ], "generated": { "by": "huntbase-hunt-generation", "from": "https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/", "gates": [ "dry-run", "lint" ], "model": "hb_google/gemini-3-flash-preview" } }, "references": [ { "url": "https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/", "name": "Unit 42 \u2014 Kimwolf v7: An Evolution of the Kimwolf Botnet" } ], "blind_spots": [ { "id": "no-network-telemetry", "risk": "A host can be exploited via ADB without generating a network row, causing the lead step to skip it.", "owner": "Network Engineering", "stage": "initial-access-adb-misuse", "question": "whether ADB connections occurred without being logged by a network sensor", "requires": "hb_network_connection with port 5555 coverage on internal segments", "remediation": "Enable flow logging for all VLANs containing IoT or Android TV devices." }, { "id": "unmanaged-iot-devices", "risk": "Unmanaged IoT boxes contribute no file or process rows; the hunt only observes the managed estate.", "owner": "Asset Management", "stage": "execution-malware-installation", "question": "whether Kimwolf is running on devices without an endpoint agent", "requires": "hb_process_activity on Android TV devices", "remediation": "Enroll Android IoT devices in a managed inventory with process auditing enabled." } ] }, "name": "Kimwolf ADB Propagation and Evasion", "description": "The Kimwolf (AISURU) botnet targets Android IoT devices by abusing unauthenticated Android Debug Bridge (ADB) services. This hunt identify inbound connections to port 5555 from suspicious external sources as a lead, then gates forensic queries for specific malware file drops and masqueraded processes. An agent correlates the initial network access with endpoint artifacts to confirm the infection chain." }, "nodes": [ { "id": "hypothesis", "type": "hypothesis", "label": "Hypothesis", "config": { "tags": [], "series": { "slug": "kimwolf-v7-an-evolution-of-the-kimwolf-botnet", "index": 1, "title": "Kimwolf v7: An Evolution of the Kimwolf Botnet", "total": 2 }, "coverage": [ { "stage": "initial-access-adb-misuse", "steps": [ "lead-adb-connections" ], "status": "covered" }, { "stage": "execution-malware-installation", "steps": [ "malware-file-drops" ], "status": "covered" }, { "stage": "defense-evasion-process-masquerading", "steps": [ "masqueraded-processes" ], "status": "covered" }, { "stage": "c2-ens-resolution", "reason": "Belongs to another part of the 'Kimwolf v7: An Evolution of the Kimwolf Botnet' series.", "status": "out_of_scope" }, { "stage": "c2-local-proxy-routing", "reason": "Belongs to another part of the 'Kimwolf v7: An Evolution of the Kimwolf Botnet' series.", "status": "out_of_scope" }, { "stage": "impact-ddos-flooding", "reason": "Belongs to another part of the 'Kimwolf v7: An Evolution of the Kimwolf Botnet' series.", "status": "out_of_scope" } ], "rationale": "An intruder exploits unauthenticated ADB services on port 5555 to drop ELF binaries and masquerades as the netd_service system process to avoid detection on Android IoT devices.", "blind_spots": [ { "id": "no-network-telemetry", "risk": "A host can be exploited via ADB without generating a network row, causing the lead step to skip it.", "owner": "Network Engineering", "stage": "initial-access-adb-misuse", "question": "whether ADB connections occurred without being logged by a network sensor", "requires": "hb_network_connection with port 5555 coverage on internal segments", "remediation": "Enable flow logging for all VLANs containing IoT or Android TV devices." }, { "id": "unmanaged-iot-devices", "risk": "Unmanaged IoT boxes contribute no file or process rows; the hunt only observes the managed estate.", "owner": "Asset Management", "stage": "execution-malware-installation", "question": "whether Kimwolf is running on devices without an endpoint agent", "requires": "hb_process_activity on Android TV devices", "remediation": "Enroll Android IoT devices in a managed inventory with process auditing enabled." } ], "scoping_notes": "Start with servers and unmanaged IoT segments. While the v7 variant targets Android, the AISURU codebase targets Linux IoT; scoping should include both platforms if unauthenticated port 5555 is exposed.", "beyond_detection": "A standard rule for port 5555 triggers on legitimate developer activity; this hunt uses a gated agent-led flow to validate network leads against endpoint file drops and rare process masquerading." } }, { "id": "lead-adb-connections", "type": "query", "label": "Inbound connections to ADB port", "config": { "dsl": "sqlite", "role": "scoping", "source": "network", "content": "SELECT device_hostname, src_endpoint_ip, src_endpoint_port, dst_endpoint_ip, dst_endpoint_port, direction, time FROM hb_network_connection WHERE dst_endpoint_port = {{adb_port}} AND (LOWER(direction) = 'inbound' OR direction IS NULL) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_network_connection", "description": "Identify hosts receiving inbound network traffic on the ADB port as a potential initial access lead.", "expected_signal": "A list of hosts receiving traffic on port 5555. Silence suggests no active ADB exposure was captured in logs." }, "parents": [ { "id": "hypothesis" } ], "primitive_config": { "dsl": "sqlite", "role": "scoping", "label": "Inbound connections to ADB port", "reads": [ "device_hostname", "src_endpoint_ip", "src_endpoint_port", "dst_endpoint_ip", "dst_endpoint_port", "direction", "time" ], "source": "hb_network_connection", "target": "network", "content": "SELECT device_hostname, src_endpoint_ip, src_endpoint_port, dst_endpoint_ip, dst_endpoint_port, direction, time FROM hb_network_connection WHERE dst_endpoint_port = {{adb_port}} AND (LOWER(direction) = 'inbound' OR direction IS NULL) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "A list of hosts receiving traffic on port 5555. Silence suggests no active ADB exposure was captured in logs.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "adb-lead-evaluator", "type": "analytic", "label": "Evaluate ADB lead", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "lead-adb-connections" ], "objective": "Examine src_endpoint_ip values from lead-adb-connections. Focus on external IPs, known residential proxy nodes, or IP addresses not part of the internal network. Identify which hosts warrant expensive endpoint forensic queries.", "description": "Filter the ADB lead for non-standard or external source IPs that indicate botnet propagation.", "max_iterations": 3, "expected_signal": "A verdict flagging hosts receiving ADB traffic from outside the internal developer range.", "success_criteria": "A per-host verdict citing suspicious source IPs and identifying the most at-risk devices." }, "parents": [ { "id": "lead-adb-connections" } ] }, { "id": "gate-on-adb", "type": "checkpoint", "label": "Gate on suspicious ADB", "config": { "fuzzy": true, "judge": "hunter", "question": "the adb-lead-evaluator finds at least one inbound connection from a non-standard or external source IP", "condition": "the adb-lead-evaluator finds at least one inbound connection from a non-standard or external source IP", "blind_spot": "no-network-telemetry", "confidence": "high", "description": "Terminate the hunt if no suspicious ADB activity is identified to save processing costs.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "adb-lead-evaluator" } ] }, { "id": "malware-file-drops", "type": "query", "label": "Kimwolf ELF binary drops", "config": { "dsl": "sqlite", "role": "detection-candidate", "source": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE (instr(',' || '{{malware_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR LOWER(file_name) LIKE 'libn%kernel.so') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "surface": "hb_file_activity", "description": "Detect the creation of known Kimwolf file indicators or the 'libn' kernel naming pattern.", "expected_signal": "Creation of libdevice.so or kernel.so, likely by an ADB shell or proxy-related process." }, "parents": [ { "id": "gate-on-adb", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "detection-candidate", "label": "Kimwolf ELF binary drops", "reads": [ "device_hostname", "file_name", "file_path", "process_name", "time" ], "source": "hb_file_activity", "target": "endpoint", "content": "SELECT device_hostname, file_name, file_path, process_name, time FROM hb_file_activity WHERE (instr(',' || '{{malware_filenames}}' || ',', ',' || LOWER(file_name) || ',') > 0 OR LOWER(file_name) LIKE 'libn%kernel.so') AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days')", "silence": "not_evidence_of_absence", "expected": "Creation of libdevice.so or kernel.so, likely by an ADB shell or proxy-related process.", "verified": "dry-run", "verified_at": "2026-09-20" } }, { "id": "masqueraded-processes", "type": "query", "label": "Rare masqueraded processes", "config": { "dsl": "sqlite", "role": "baseline", "source": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, on_disk, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_name) LIKE '%netd_service' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name, process_path, process_cmd_line, on_disk", "surface": "hb_process_activity", "description": "Identify processes masquerading as netd_service that stand out from legitimate system noise.", "expected_signal": "A netd_service process running from a non-standard path (e.g., /data/local/tmp) or with a low host count." }, "parents": [ { "id": "gate-on-adb", "branch": "on_supports" } ], "primitive_config": { "dsl": "sqlite", "role": "baseline", "label": "Rare masqueraded processes", "reads": [ "device_hostname", "process_name", "process_path", "process_cmd_line", "on_disk", "time" ], "source": "hb_process_activity", "target": "endpoint", "content": "SELECT device_hostname, process_name, process_path, process_cmd_line, on_disk, COUNT(DISTINCT device_hostname) AS hosts, MIN(time) AS first_seen FROM hb_process_activity WHERE LOWER(process_name) LIKE '%netd_service' AND ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY process_name, process_path, process_cmd_line, on_disk", "silence": "not_evidence_of_absence", "baseline": { "window": "{{lookback_days}}d", "compare": "first_seen" }, "expected": "A netd_service process running from a non-standard path (e.g., /data/local/tmp) or with a low host count.", "verified": "dry-run", "prevalence": { "by": "device_hostname", "key": [ "process_name", "process_path" ], "rare_below": 3 }, "verified_at": "2026-09-20" } }, { "id": "triage-infection", "type": "analytic", "label": "Triage Kimwolf infection", "config": { "cite": "required", "tools": [ "endpoint", "network" ], "context": [ "adb-lead-evaluator", "malware-file-drops", "masqueraded-processes" ], "objective": "Determine if any host shows a sequence of suspicious ADB network activity followed by the creation of Kimwolf binaries or a rare instance of a netd_service process.", "description": "Correlate the suspicious ADB lead with confirmed binary drops and process masquerading per host.", "max_iterations": 4, "expected_signal": "A per-host verdict confirming whether the sequence indicates a botnet compromise.", "success_criteria": "A verdict of malicious | suspicious | benign citing specific rows across the three surfaces." }, "parents": [ { "id": "malware-file-drops", "kind": "merge" }, { "id": "masqueraded-processes", "kind": "merge" } ] }, { "id": "decision-route", "type": "checkpoint", "label": "Route on verdict", "config": { "fuzzy": true, "judge": "hunter", "question": "the triage-infection verdict is malicious or suspicious for at least one host, confirming ADB activity followed by malware artifacts", "condition": "the triage-infection verdict is malicious or suspicious for at least one host, confirming ADB activity followed by malware artifacts", "blind_spot": "unmanaged-iot-devices", "confidence": "high", "description": "Route confirmed infections to isolation and analyst review.", "checkpoint_type": "mandatory" }, "parents": [ { "id": "triage-infection" } ] }, { "id": "isolate-host", "type": "action", "label": "Isolate host", "config": { "target": "endpoint", "description": "Contain the infected device to prevent it from participating in botnet DDoS activity.", "instructions": "Isolate the host immediately. Capture the netd_service binary and any identified .so files from /data/local/tmp or other user-writable directories.", "action_approval": "required" }, "parents": [ { "id": "decision-route", "branch": "on_supports" } ] }, { "id": "manual-review", "type": "task", "label": "Analyst forensic review", "config": { "assignee": "analyst", "description": "Confirm the infection details and investigate the origin of the ADB traffic.", "instructions": "Review the cited rows. Confirm the source IPs for the ADB connections against residential proxy feeds. Verify that the netd_service binary is not a legitimate part of the device OS for that specific hardware vendor." }, "parents": [ { "id": "gate-on-adb", "branch": "default" }, { "id": "gate-on-adb", "branch": "on_unavailable" }, { "id": "decision-route", "branch": "default" }, { "id": "decision-route", "branch": "on_unavailable" }, { "id": "decision-route", "branch": "on_refutes" }, { "id": "isolate-host" } ] }, { "id": "close-out", "type": "task", "label": "Close out", "config": { "assignee": "analyst", "description": "Finalize the hunt and record remediation actions taken.", "instructions": "Record the findings. Recommend disabling ADB globally for all Android IoT devices in the estate. If the malware filenames were confirmed, promote the file activity query to a detection rule." }, "parents": [ { "id": "gate-on-adb", "branch": "on_refutes" }, { "id": "manual-review" } ] } ] }