Kimwolf Timeline
This timeline chronicles the emergence, growth, and ongoing battle against the interconnected botnets and variants from their origins.
The Aisuru / Kimwolf / BadBox Botnet Saga
Document Purpose: This timeline chronicles the emergence, growth, and ongoing battle against the interconnected Aisuru, Kimwolf, and BadBox 2.0 botnets from their origins through January 2026. All events are cited with sources listed at the end of this document.
Last Updated: January 29, 2026
2022-2023: Origins
Late 2022: Original BadBox Discovered
The first BadBox botnet is identified after researchers discover approximately 74,000 off-brand Android TV devices infected with backdoor malware. The devices were compromised prior to purchase through supply chain attacks.[1]
2022: Aisuru Team Forms
According to anonymous sources who later came forward, three individuals codenamed "Snow," "Tom," and "Forky" form the Aisuru team after several successful collaborations, including work on the CatDDoS botnet.[2]
2023: BadBox Formally Identified
Security researchers formally identify and name the BadBox malware, which primarily consists of Android devices compromised with backdoor malware prior to purchase.[3]
2024: BadBox Disrupted, Aisuru Emerges
2024: Germany Disrupts Original BadBox
Germany's cybersecurity agency successfully disrupts the original BadBox botnet by sinkholing communications between infected devices and attacker infrastructure. However, researchers find the malware on 192,000 devices just one week later, now including more mainstream brands like Yandex TVs and Hisense smartphones.[1]
August 2024: Aisuru Botnet First Disclosed
QiAnXin XLab first discloses the Aisuru botnet, which participates in DDoS attacks against the distribution platform for the video game "Black Myth: Wukong."[2]
2025: Escalation and Record-Breaking Attacks
Q1 2025
March 2025: BadBox 2.0 Identified
HUMAN Security's Satori Threat Intelligence team publishes analysis identifying BadBox 2.0, confirming over 1 million consumer devices have become infected. The infected devices are Android Open Source Project devices manufactured in China and shipped globally, with infections observed in 222 countries.[4]
April 2025: Aisuru Compromises Router Firmware Server
The Aisuru group member "Tom" successfully breaches a Totolink router firmware update server, setting the firmware upgrade URL to download and execute a malicious script. This adds over 100,000 bots to their arsenal. The downloader domain "updatetoto.tw" is created on April 25 and rapidly climbs global domain rankings.[2]
Late April 2025: Aisuru's Enemies Begin Leaking Information
Due to the Aisuru group's poor reputation in the DDoS community, rivals begin leaking details on social media. Under a Cloudflare post about mitigating a record 5.8 Tbps attack, someone replies: "This came from 340k Totolink routers!" Further leaks include a screenshot of the botnet panel showing over 300,000 active bots.[2]
Q2 2025
May 12, 2025: Record DDoS Attack on KrebsOnSecurity
KrebsOnSecurity, protected by Google Shield, is targeted with a massive DDoS attack attributed to the Aisuru botnet. The attack is characterized as a "test run" or demonstration of capability.[5]
Mid-May 2025: 7.3 Tbps Attack Blocked
Cloudflare blocks a 7.3 Tbps DDoS attack targeting a hosting provider. The attack lasted only 45 seconds but delivered 37.4 terabytes of traffic - the equivalent of over 9,000 HD movies.[6]
June 5, 2025: FBI Issues BadBox 2.0 Public Service Announcement
The FBI releases PSA I-060525 titled "Home Internet Connected Devices Facilitate Criminal Activity," warning the public about cybercriminals exploiting IoT devices connected to home networks. The FBI warns that most infected devices were manufactured in China and can be compromised either before purchase or during the setup process.[3]
Q3 2025
July 11, 2025: Google Files Lawsuit Against BadBox 2.0 Operators
Google files a "John Doe" lawsuit in New York federal court (Google LLC v. Does 1-25) against 25 unidentified defendants in China accused of operating BadBox 2.0. Google describes it as a botnet of over 10 million unsanctioned Android streaming devices engaged in advertising fraud. The court grants a preliminary injunction allowing Google to disrupt the botnet's infrastructure.[7]
August 6, 2025: RapperBot Author Arrested
"Ethan J Foltz," the author of the RapperBot botnet, is arrested. The Aisuru operator "Snow" later uses this identity to mock the RapperBot operation, contributing to Aisuru's poor reputation in the DDoS community.[2]
September 2, 2025 (Labor Day Weekend): Record 11.5 Tbps DDoS Attack
Cloudflare detects and autonomously mitigates what was then the largest DDoS attack ever recorded, peaking at 11.5 terabits per second and 5.1 billion packets per second. The attack lasted approximately 35 seconds and originated from a combination of compromised IoT devices and cloud providers.[8]
Mid-September 2025: Multi-Terabit Gaming Attacks Begin
Aisuru launches a series of multi-terabit strikes targeting networks serving popular online gaming communities, including Minecraft servers, Steam, and Riot games. These attacks appear to be warm-up runs for larger assaults.[9]
September 16, 2025: XLab Publishes Deep Aisuru Analysis
QiAnXin XLab publishes "The Most Powerful Ever? Inside the 11.5Tbps-Scale Mega Botnet AISURU," detailing the botnet's structure, the three key figures (Snow, Tom, Forky), and how an anonymous source provided intelligence hoping to dismantle Aisuru similarly to the Fodcha botnet takedown.[2]
September 22, 2025: Record Shattered: 22.2 Tbps Attack
Cloudflare autonomously blocks a hyper-volumetric DDoS attack peaking at 22.2 Tbps and 10.6 billion packets per second - twice as large as anything previously seen on the internet. The September 11.5 Tbps record stood for just three weeks.[10]
Q4 2025
October 8, 2025: 29.6 Tbps Attack Disrupts Major US ISPs
A massive attack campaign linked to the Aisuru botnet generates nearly 29.6 Tbps of DDoS packets, temporarily disrupting major online gaming platforms. The bulk of the botnet's power lies in compromised devices hosted under leading US ISPs including AT&T, Comcast, Verizon, T-Mobile, and Charter. TCPShield reports being flooded with over 15 terabits of junk traffic per second and is subsequently told by upstream provider OVH they are no longer welcome as a customer.[9]
Early October 2025: Black Lotus Labs Begins Null-Routing Aisuru/Kimwolf C2s
Black Lotus Labs at Lumen Technologies begins null-routing traffic to command-and-control nodes associated with the Aisuru/Kimwolf botnet. They will ultimately null-route more than 550 C2 nodes.[11]
October 24, 2025: Kimwolf Botnet Sample Received by XLab
XLab receives a brand-new botnet sample from a security community partner. The most distinctive feature is its C2 domain (14emeliaterracewestroxburyma02132[.]su), which ranks 2nd in Cloudflare Domain Rankings - a week later it surpasses Google to claim the #1 spot globally. Based on its use of the wolfSSL library, researchers name it "Kimwolf."[12]
October 24, 2025: Largest Cloud DDoS Attack Ever: 15.72 Tbps on Azure
Microsoft Azure's DDoS Protection platform automatically detects and mitigates a 15.72 Tbps attack - the largest DDoS attack ever observed in the cloud. The multi-vector assault targeted a single endpoint in Australia and was traced to the Aisuru botnet. The attack involved over 500,000 source IP addresses from compromised residential devices worldwide.[13]
October 27, 2025: NETSCOUT Publishes Aisuru Threat Summary
NETSCOUT publishes a detailed threat summary on Aisuru and related TurboMirai-class botnets, documenting attacks exceeding 20 Tbps and 4 billion packets per second. They note that multiple broadband access network operators experienced significant operational impact due to outbound attacks exceeding 1.5 Tbps launched from infected customer devices.[14]
Early October 2025: 300% Surge in New Kimwolf Bots
Black Lotus Labs observes a 300% surge in new bots added to Kimwolf over a 7-day period, reaching 800,000 total bots by mid-month.[11]
Late October 2025: Synthient Discovers resi[.]to Discord Server
Benjamin Brundage, founder of proxy-tracking firm Synthient, discovers that people selling various proxy services benefiting from the Aisuru and Kimwolf botnets are doing so on a Discord server called resi[.]to. When KrebsOnSecurity joins as a silent observer, the server has fewer than 150 members, including "Shox" (Resi Rack's co-founder) and his business partner "Linus."[15]
November 12, 2025: Synthient Honeypot Detects Increased Targeting
Synthient's honeypot network observes an increase in targeting of the domain xd[.]resi[.]to from IPIDEA's proxy network. This domain resolves to 0.0.0.0, pointing to the device running the proxy SDK.[16]
November 19-22, 2025: 1.7 Billion DDoS Attack Commands Observed
XLab observes Kimwolf issuing over 1.7 billion DDoS attack commands, pushing its C2 domain to the top position in Cloudflare's global domain popularity rankings, surpassing google.com.[17]
November 30, 2025: XLab Captures New Kimwolf Sample, Takes Over C2
XLab captures another new Kimwolf sample and successfully takes over one of its C2 domains, gaining the opportunity to directly observe the botnet's operating scale. Over three days (December 3-5), they observe approximately 2.7 million distinct source IP addresses connecting to their registered C2.[12]
December 1, 2025: Synthient Confirms IPIDEA Exploitation
Synthient confirms that Kimwolf botnet operators are tunneling through IPIDEA's proxy network into the local networks of systems running IPIDEA's proxy software. The attackers drop malware by directing infected systems to visit a specific address and call out the passphrase "krebsfiveheadindustries."[18]
XLab observes approximately 1.83 million Bot IPs - a historical peak. On this day, parts of Kimwolf's normal C2s were taken down by relevant organizations, causing large numbers of bots to fail connecting to original C2s and turn to XLab's preemptively registered C2.[12]
December 8, 2025: Definitive Link Confirmed Between Kimwolf and Aisuru
XLab confirms "definitive evidence" that the same cybercriminal actors and infrastructure were used to deploy both Kimwolf and Aisuru when they witness both botnet strains being distributed by the same Internet address at 93.95.112[.]59, which is assigned to Lehi, Utah-based Resi Rack LLC.[15]
December 17, 2025: XLab Publishes Comprehensive Kimwolf Analysis
QiAnXin XLab publishes "Kimwolf Exposed: The Massive Android Botnet with 1.8 Million Infected Devices," providing exhaustive technical analysis of the malware, its connection to Aisuru, and its exploitation of residential proxy networks.[12]
December 27, 2025: IPIDEA Patches Vulnerability
IPIDEA implements a security patch to block access to local network devices and various sensitive ports after receiving notification from Synthient about the vulnerability being exploited by Kimwolf.[16]
December 30, 2025: 2 Million IPIDEA Addresses Exploited
Synthient reports tracking roughly 2 million IPIDEA addresses exploited by Kimwolf in the previous week.[18]
January 2026: Public Exposure and Major Takedowns
January 2, 2026: Krebs Publishes "The Kimwolf Botnet is Stalking Your Local Network"
Brian Krebs publishes the first in-depth public report on Kimwolf, revealing how the botnet exploits residential proxy services to spread to local networks. Within hours, the resi[.]to Discord server's historical chat records are erased and replaced with a profanity-laced message for Synthient's founder, then the entire server disappears.[18]
January 2, 2026: Kimwolf Operators Move to Telegram, Claim 3.5 Million Devices
Active members of the defunct resi[.]to Discord server move to a Telegram channel where they post Synthient founder Benjamin Brundage's personal information. A user named "Richard Remington" posts a crude sketch claiming Dort and Snow are now in control of 3.5 million devices infected by Aisuru and/or Kimwolf.[15]
January 5, 2026: Multiple Outlets Cover Kimwolf
The Hacker News, SecurityWeek, Security Affairs, and other major cybersecurity publications publish coverage of the Kimwolf botnet, confirming over 2 million infected devices and noting the botnet's size may be much larger - with roughly 12 million unique IP addresses associated with it seen every week.[16]
January 8, 2026: Krebs Publishes "Who Benefited from the Aisuru and Kimwolf Botnets?"
Krebs identifies the current administrators of Kimwolf as individuals using the nicknames "Dort" (a Canadian resident) and "Snow." The investigation traces infrastructure to Resi Rack LLC in Utah and reveals the company was openly advertising proxy services on BlackHatWorld forums.[15]
January 13, 2026: Infoblox Publishes Enterprise Exposure Report
Infoblox reveals that nearly 25% of their Threat Defense Cloud customers made queries to Kimwolf-related domains since October 1, 2025, suggesting widespread presence of proxy endpoints in enterprise networks across education, healthcare, government, and finance sectors.[19]
January 14, 2026: Black Lotus Labs Announces 550+ C2 Nodes Null-Routed
Black Lotus Labs at Lumen Technologies announces they have null-routed traffic to more than 550 command-and-control nodes associated with the Aisuru/Kimwolf botnet since early October 2025.[11]
January 20, 2026: Krebs Publishes "Kimwolf Botnet Lurking in Corporate, Govt. Networks"
Krebs reveals that Synthient found at least 33,000 affected Internet addresses at universities and colleges, and nearly 8,000 IPIDEA proxies within U.S. and foreign government networks. Spur's webinar reveals residential proxies in nearly 300 government-owned networks, including many DoD networks, plus 318 utility companies, 166 healthcare organizations, and 141 banking/finance companies.[20]
January 26, 2026: Krebs Reveals Dort's Unauthorized Access to BadBox 2.0
Krebs publishes "Who Operates the Badbox 2.0 Botnet?" revealing that a former associate of Dort and Snow shared a screenshot showing the Kimwolf botmasters logged into the BadBox 2.0 botnet control panel. The account "ABCD" belongs to Dort, who figured out how to add his email as a valid user. This gives Dort a backup method to spread Kimwolf directly to BadBox 2.0's 10+ million devices, bypassing the patches implemented by normal proxy providers.[21]
January 29, 2026: Google Disrupts IPIDEA - World's Largest Residential Proxy Network
Google announces it has worked with partners to disrupt IPIDEA, described as one of the largest residential proxy networks in the world. Using a federal court order, Google seizes control of dozens of domains used to control devices and proxy traffic. IPIDEA's website becomes inaccessible. Google Threat Intelligence Group reveals that in a single seven-day period in January 2026, over 550 individual threat groups from China, DPRK, Iran, and Russia were utilizing IPIDEA exit nodes. The action is projected to disconnect over 9 million Android devices from the network.[22]
Summary: Key Statistics
| Metric | Value | Source Date |
|---|---|---|
| Kimwolf infected devices (confirmed) | 2+ million | January 2026 |
| Kimwolf-associated unique IPs per week | ~12 million | January 2026 |
| BadBox 2.0 infected devices | 10+ million | July 2025 |
| IPIDEA devices disconnected by Google | 9+ million | January 2026 |
| Enterprise customers with Kimwolf queries | ~25% | January 2026 |
| Government networks with proxy endpoints | ~300 | January 2026 |
| Largest recorded DDoS attack | 31.4 Tbps | November 2025 |
| Threat groups using IPIDEA (7-day period) | 550+ | January 2026 |
| C2 nodes null-routed by Black Lotus Labs | 550+ | January 2026 |
Sources
[1] BleepingComputer (June 2025): "FBI: BADBOX 2.0 Android malware infects millions of consumer devices"
https://www.bleepingcomputer.com/news/security/fbi-badbox-20-android-malware-infects-millions-of-consumer-devices/
[2] QiAnXin XLab (September 16, 2025): "The Most Powerful Ever? Inside the 11.5Tbps-Scale Mega Botnet AISURU"
https://blog.xlab.qianxin.com/super-large-scale-botnet-aisuru-en/
[3] FBI Internet Crime Complaint Center (June 5, 2025): PSA I-060525 "Home Internet Connected Devices Facilitate Criminal Activity"
https://www.ic3.gov/PSA/2025/PSA250605
[4] HUMAN Security (March 2025): "Satori Threat Intelligence Disruption: BADBOX 2.0"
https://www.humansecurity.com/learn/blog/satori-threat-intelligence-disruption-badbox-2-0/
[5] DigiCert/Vercara (May 29, 2025): "Aisuru Ascending: The Near-Record Attack on Krebs and What It Means for You"
https://vercara.digicert.com/resources/aisuru-ascending-the-near-record-attack-on-krebs-and-what-it-means-for-you
[6] SecurityWeek (September 3, 2025): "Cloudflare Blocks Record 11.5 Tbps DDoS Attack"
https://www.securityweek.com/cloudflare-blocks-record-11-5-tbps-ddos-attack/
[7] The Hacker News (July 18, 2025): "Google Sues 25 Chinese Entities Over BADBOX 2.0 Botnet Affecting 10M Android Devices"
https://thehackernews.com/2025/07/google-sues-25-chinese-entities-over.html
[8] The Hacker News (September 3, 2025): "Cloudflare Blocks Record-Breaking 11.5 Tbps DDoS Attack"
https://thehackernews.com/2025/09/cloudflare-blocks-record-breaking-115.html
[9] CSO Online (October 13, 2025): "Aisuru's 30 Tbps botnet traffic crashes through major US ISPs"
https://www.csoonline.com/article/4071594/aisurus-30-tbps-botnet-traffic-crashes-through-major-us-isps.html
[10] Security Affairs (September 24, 2025): "Cloudflare mitigates largest-ever DDoS attack at 22.2 Tbps"
https://securityaffairs.com/182521/security/cloudflare-mitigates-largest-ever-ddos-attack-at-22-2-tbps.html
[11] The Hacker News (January 14, 2026): "Researchers Null-Route Over 550 Kimwolf and Aisuru Botnet Command Servers"
https://thehackernews.com/2026/01/kimwolf-botnet-infected-over-2-million.html
[12] QiAnXin XLab (December 17, 2025): "Kimwolf Exposed: The Massive Android Botnet with 1.8 Million Infected Devices"
https://blog.xlab.qianxin.com/kimwolf-botnet-en/
[13] CyberInsider (November 17, 2025): "Microsoft Azure neutralized a 15.7 Tbps DDoS attack by the AISURU botnet"
https://cyberinsider.com/microsoft-azure-neutralized-a-15-7-tbps-ddos-attack-by-the-aisuru-botnet/
[14] NETSCOUT (October 27, 2025): "ASERT Threat Summary: Aisuru and Related TurboMirai Botnet DDoS Attack Mitigation and Suppression"
https://www.netscout.com/blog/asert/asert-threat-summary-aisuru-and-related-turbomirai-botnet-ddos
[15] Krebs on Security (January 8, 2026): "Who Benefited from the Aisuru and Kimwolf Botnets?"
https://krebsonsecurity.com/2026/01/who-benefited-from-the-aisuru-and-kimwolf-botnets/
[16] Security Affairs (January 5, 2026): "Kimwolf botnet leverages residential proxies to hijack 2M+ Android devices"
https://securityaffairs.com/186559/malware/kimwolf-botnet-leverages-residential-proxies-to-hijack-2m-android-devices.html
[17] SecurityWeek (December 19, 2025): "'Kimwolf' Android Botnet Ensnares 1.8 Million Devices"
https://www.securityweek.com/kimwolf-android-botnet-ensnares-1-8-million-devices/
[18] Krebs on Security (January 2, 2026): "The Kimwolf Botnet is Stalking Your Local Network"
https://krebsonsecurity.com/2026/01/the-kimwolf-botnet-is-stalking-your-local-network/
[19] Infoblox (January 13, 2026): "Kimwolf Botnet Risks for Enterprises and Institutions"
https://www.infoblox.com/blog/threat-intelligence/kimwolf-howls-from-inside-the-enterprise/
[20] Krebs on Security (January 20, 2026): "Kimwolf Botnet Lurking in Corporate, Govt. Networks"
https://krebsonsecurity.com/2026/01/kimwolf-botnet-lurking-in-corporate-govt-networks/
[21] Krebs on Security (January 26, 2026): "Who Operates the Badbox 2.0 Botnet?"
https://krebsonsecurity.com/2026/01/who-operates-the-badbox-2-0-botnet/
[22] Google Cloud Blog (January 29, 2026): "Disrupting the World's Largest Residential Proxy Network"
https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest-residential-proxy-network
[23] Cloudflare (December 2025): "2025 Q3 DDoS Threat Report"
https://blog.cloudflare.com/ddos-threat-report-2025-q3/
[24] Cloudflare (December 19, 2025): "The 2025 Cloudflare Radar Year in Review"
https://blog.cloudflare.com/radar-2025-year-in-review/
Compiled by Grand Avenue Broadband Security Operations
Last Updated: January 29, 2026 5:00 PM MST
