Kimwolf Android botnet abuses residential proxies to infect internal devices

The report details the Kimwolf (Aisuru) Android botnet’s rapid growth to nearly two million compromised devices by scanning and exploiting residential proxy networks that expose unauthenticated ADB services; attackers deliver payloads via netcat/telnet to install bot payloads used for massive DDoS (noted as the largest publicly disclosed at 29.7 Tbps), proxy resale, and ad/sdk monetization, and researchers recommend blocking local network access on proxy providers, replacing or wiping infected devices, and avoiding low-cost/unverified Android TV boxes.