Kimwolf Hackers Breach Rival Botnet's Controls
Source: wsj.com
TL;DR
- Hackers behind the Kimwolf botnet, infecting over 2 million devices, have secretly accessed the rival Badbox 2.0 botnet's control panel.
- Kimwolf spreads by exploiting residential proxy networks to hack into home devices like cheap Android TV boxes.
- This backdoor access lets them bypass defenses, fueling massive cyber threats from everyday gadgets.
- Google and the FBI are hunting the operators, exposing links to Chinese tech firms.
The story at a glance
Operators of the massive Kimwolf botnet have infiltrated Badbox 2.0, a China-based network of over 10 million infected streaming devices, by gaining control panel access. This revelation, reported now amid escalating botnet takedowns, shows how hackers chain one botnet to supercharge another.
Key moments & milestones
- 2025: Google sues 25 unidentified defendants over Badbox 2.0, a botnet pre-infecting Android streaming boxes for ad fraud.
- November 2025: Kimwolf and Aisuru botnets unleash a 31.4 Tbps DDoS attack.
- Early 2026: Kimwolf surges to over 2 million infections, mainly via vulnerable IoT devices like TV boxes.
- January 2026: Krebs on Security exposes Kimwolf's local network stalking and names admins Dort and Snow.
- Recent: Kimwolf operators share screenshot of Badbox 2.0 panel login as user "Chen" tied to 34557257@qq.com.
Signature highlights
- Kimwolf tricks residential proxy services to relay commands past home firewalls, targeting unsecured IoT like Android TV boxes and photo frames.
- Badbox 2.0 infects devices pre-sale or via shady app stores, powering ad fraud across 10 million+ units.
- Email 34557257@qq.com links to Chinese firms like Beijing Hong Dake Wang Science & Technology Co Ltd. and others.
- Proxy firm Synthient warned 11 providers; most fixed vulnerabilities, but Kimwolf had this hidden Badbox ace.
Key quotes
"The cybercriminals in control of Kimwolf — a disruptive botnet that has infected more than 2 million devices — recently shared a screenshot indicating they’d compromised the control panel for Badbox 2.0."[1]
Why it matters
This botnet-on-botnet hack amplifies risks from cheap gadgets, turning homes into launchpads for DDoS attacks, ad fraud, and spying. It pressures tech giants and law enforcement to dismantle pre-infected supply chains. Watch for DOJ disruptions and proxy network lockdowns to curb the next surge.