Date: 08/12/2026
Severity: High
Summary
A new Kimwolf v7 Android/IoT botnet variant has been identified with enhanced DDoS capabilities and stronger C2 resilience. The botnet mainly targets Android TV boxes and set-top boxes, adding an HTTP/2-based flood that mimics complete browser fingerprints. This technique makes malicious traffic harder to distinguish from legitimate web browsing. Kimwolf v7 uses hard-coded Ethereum-based endpoints to resolve ENS domains and obtain C2 addresses, with a Tor .onion service as a backup. It also includes a local proxy architecture for flexible routing between the clearnet and Tor, helping bypass C2 takedown efforts. The variant was discovered on February 3, 2026, during threat hunting following public reports from XLab, Synthient, Infoblox, Cloudflare, and others.
Indicators of Compromise (IOC) List
Domains/URLs | eth.rpcuniverse.com rpcuniverse.com avax.rpcuniverse.com |
IP Address | 23.94.221.104 212.193.31.158 212.193.31.119 212.193.31.122 212.193.31.102 212.193.31.92 |
Hash | 406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ff
345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49
2ec2e85b0358e0c681cb5067489a9086ec97dbbf7e3c952dd9cd496b319d5af5
951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36
f07821e313c16cbbd82def45094a22c8d474164051bdbc7648d6869e012014b4
f3e8a55a2a3ea7c7b6676e90f4f49a2c55b13065b68ee50c51cc35fe2b5c3237
9470c68f9b6fe5f90d61891b95623afd7b4298815b0f95e25610e1c09008dc24
8242443dfcec66e3fe04cbfa2fbd211ad34065ee07aa93813d792a437caab212
421111a57b0a4224c052fa4108d90429d579974b5b5111ed2e58516ba09422ca
2a1d96f1b066877812587ac94f45f82dfff5f5f9
d759364844d78a728505fb0485c3adbc
036bcb62be72c4663b9564955f93b05f
33faca1e0090f6b12eff703daf4606e4
76554ad09897ac723a850eaf8c525efa
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "eth.rpcuniverse.com" or url like "eth.rpcuniverse.com" or siteurl like "eth.rpcuniverse.com" or domainname like "avax.rpcuniverse.com" or url like "avax.rpcuniverse.com" or siteurl like "avax.rpcuniverse.com" or domainname like "rpcuniverse.com" or url like "rpcuniverse.com" or siteurl like "rpcuniverse.com" |
Detection Query 2 : | dstipaddress IN ("212.193.31.122","23.94.221.104","212.193.31.92","212.193.31.119","212.193.31.158","212.193.31.102") or srcipaddress IN ("212.193.31.122","23.94.221.104","212.193.31.92","212.193.31.119","212.193.31.158","212.193.31.102") |
Detection Query 3 : | md5hash IN ("036bcb62be72c4663b9564955f93b05f","33faca1e0090f6b12eff703daf4606e4","d759364844d78a728505fb0485c3adbc","76554ad09897ac723a850eaf8c525efa")
|
Detection Query 4 : | sha1hash In ("2a1d96f1b066877812587ac94f45f82dfff5f5f9") |
Detection Query 5 : | sha256hash IN ("345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49","f07821e313c16cbbd82def45094a22c8d474164051bdbc7648d6869e012014b4","406647de09a0ffa279756b4ccb344b1b76a333320c5b50fd367901fa006cf0ff","421111a57b0a4224c052fa4108d90429d579974b5b5111ed2e58516ba09422ca","2ec2e85b0358e0c681cb5067489a9086ec97dbbf7e3c952dd9cd496b319d5af5","8242443dfcec66e3fe04cbfa2fbd211ad34065ee07aa93813d792a437caab212","951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36","f3e8a55a2a3ea7c7b6676e90f4f49a2c55b13065b68ee50c51cc35fe2b5c3237","9470c68f9b6fe5f90d61891b95623afd7b4298815b0f95e25610e1c09008dc24")
|
Reference:
https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/