Inside Kimwolf: How 1.8 Million Android TVs Became a DDoS Botnet Army

In December 2025, cybersecurity researchers discovered the Kimwolf botnet had hijacked over 1.8 million Android-based smart TVs, set-top boxes, and tablets globally. The attackers leveraged the NDK (Native Development Kit) to compile malware that turned these consumer devices into a massive botnet used primarily for launching large-scale distributed denial-of-service (DDoS) attacks. The infected endpoints were recruited silently and spread across both residential and enterprise networks, enabling the attackers to conduct coordinated, high-bandwidth attacks and evade conventional network defenses. Initial findings also suggest a link between Kimwolf and the previously observed AISURU botnet, indicating possible collaboration or shared tooling between threat actors.

This incident highlights a disturbing trend: threat actors increasingly targeting loosely protected IoT and smart device ecosystems for botnet creation. The scale and performance of Kimwolf underscore the growing risk posed by unpatched consumer electronics, calling for urgent improvements in east-west traffic security, segmentation, and network visibility across hybrid environments.

The Kimwolf botnet incident demonstrates how rapidly adversaries are weaponizing vulnerable consumer IoT devices to launch DDoS attacks that can overwhelm enterprise defenses and critical infrastructure. With internet-connected TVs and set-top boxes now mainstream, organizations and service providers must urgently reassess their security controls for unmanaged devices and implement robust segmentation and monitoring strategies.