Worldwide Kimwolf Malware

URGENT SECURITY ALERT

Worldwide Malware Outbreak Affecting Home Networks

SUMMARY: A massive malware outbreak called "Kimwolf" is infecting smart TVs, streaming boxes, digital picture frames, and other devices in home networks worldwide. Once one infected device enters your network, it actively scans for and infects other devices. We believe recent holiday travel, with family members and friends, visiting and bringing infected phones and devices into homes, has accelerated the spread. Protect yourself by removing cheap no-name streaming devices (anything that promises cheap/free TV or movies), keeping all devices updated, avoiding any "jailbroken" or "hacked" or "friend fixed it for me so I get a ton of free TV and movies" FireStick, FireTV, FireCube, Roku, and similar devices EVEN if they come from legitimate sources like Amazon, eBay, etc. You should ensure you have installed security software on phones and computers, and make sure they are all up to date! More detailed information below, and more to come in the days ahead.

IT SPREADS: Once a single infected device enters your home network, it actively scans for and infects other vulnerable devices on the same network.^[1] We believe the spike in activity around the holidays is directly related to people traveling, family members and friends visiting, with possibly infected phones and devices. This is essentially a malware epidemic that spreads as people move about.

WARNING: Security researchers and the FBI have confirmed that many of these devices come with malware pre-installed directly from the factory - they are infected before you even open the box.^[3] These devices are sold on major US retailers including Amazon, eBay, and AliExpress.^[4] In July 2025, Google filed a lawsuit against a botnet operation involving over 10 million infected devices.^[5] Many of the same infected models are still being sold today.

WHY THIS MATTERS: "Smart" devices are enormous security problems because most manufacturers of these devices are not security or software experts - they make and sell light bulbs, thermostats, or cameras.^[6] They have ZERO incentive (and they make no money) by providing ongoing software fixes and security patches on the devices they sell! (so, they usually dont) Security research shows that manufacturers rarely provide firmware updates, and some devices are designed with no way to update at all.^[7] Studies show over half of smart device owners have never updated their devices even once.^[8] Cheap WiFi light bulbs, no-name (or name you can't pronounce) wireless cameras, and bargain digital picture frames, smart home control screens, Smart TVs (espeically off brands), and any other device with a screen or touch screen (which tend to run Android) are especially risky.

AVOID KASPERSKY: The U.S. Department of Commerce banned Kaspersky software in June 2024 due to national security concerns about Russian government access to user systems. Kaspersky can no longer provide security updates to U.S. customers.^[9] If you have Kaspersky installed, uninstall it and switch to an alternative.

MORE INFORMATION COMING: This is the first in a series of notices about this threat. Over the coming days (and, likely weeks), we will send additional information about: which specific devices are at risk, why this malware is so difficult to stop, what we and other internet providers are doing to combat it, and detailed steps to protect your home network.

BUT WE NEED YOUR HELP: We have no way to "clean" or remove infected devices from Subscriber networks. We continue to see infected devices attempting malicious connections from subscriber homes every single day. Based on one company's data that showed nearly 25% of their customers have at least one infected device,^[10] many of you likely have at least one compromised device right now. It is imperative that you work with your local IT professional, a trusted technical friend or family member, and/or your employer's IT department to ensure your systems are protected, updated, and clean from malware.

For suspected infected devices that are not computers, phones, tablets, or other well-supported devices from trusted manufacturers who provide regular firmware and software updates, the only known remediation is to completely take the device offline. Security researchers explicitly recommend: "If flagged, the infected TV box should be wiped or destroyed."^[11]

CONTENT WARNING: Some technical articles may contain offensive language. The malware creators embedded vulgar names and lagunage into their code, which researchers reference in their reports.