[HN Gopher] The Kimwolf botnet is stalking your local network
___________________________________________________________________
The Kimwolf botnet is stalking your local network
Author : SamValYlieRcHE2
Score : 105 points
Date : 2026-01-03 02:04 UTC (2 days ago)
(HTM) web link (krebsonsecurity.com)
(TXT) w3m dump (krebsonsecurity.com)
| ConorSheehan1 wrote:
| Very interesting! A tutorial to check if kimwolf is running on
| your network would be nice
| nubinetwork wrote:
| Based on the article, try looking for android devices with adb
| running on the network.
| thenthenthen wrote:
| This article[0] includes a link to a online checker:
| https://synthient.com/check
|
| Have not tested it myself ymmv.
|
| [0] https://synthient.com/blog/a-broken-system-fueling-
| botnets
| nubinetwork wrote:
| It only references a database of publicly scanned IPs, it
| won't help you if the device is behind a nat router.
| HappyPanacea wrote:
| Does someone know if the port must be 5555 for this botnet?
| tgv wrote:
| It's the Android debugger port, and it's used for
| infection, but the article doesn't exclude other methods
| nor mentions ports used by the malware.
| pamcake wrote:
| Not exactly the answer but if you have one of the affected
| mentioned devices it should be listening on TCP port 5555. You
| can do a port scan for that. nmap -Pn
| 192.168.0.0/16 -p 5555
|
| Replace netmask as appropriate.
|
| Now that it's publicly known I guess it's possible that they
| will close the door post-infection to avoid detecton. And it
| won't detect any other devices it's spread further to.
|
| If you have a cheapo Android-based TV box or stick like the
| ones mentioned, throw it out or reflash it with Armbian after
| forensics.
|
| I'm sure there are HN readers out there who have one of these.
| They were very popular a couple of years back.
| BloodyIron wrote:
| Well the first thing to check is, do you own and operate any of
| these janky Android "TV" boxes sold by companies nobody has
| heard of? If yes? Then there's probably your answer.
| pamcake wrote:
| This is wild.
|
| It must be crowded on these devices by now - it may be a bit
| misleading to think of it as a single botnet when there are
| multiple unrelated entities controlling the same devices via the
| same methods.
| haburka wrote:
| I love how frequently Botnet creators reference Krebs. Like they
| are his biggest fans, and they just want a shoutout on his blog.
| BloodyIron wrote:
| How is it not obvious to everyone reading HN that janky Android
| "TV" boxes (like the article references) are a by-default threat?
|
| Like seriously, many of them are sold for stupid cheap prices
| like $5/ea. Or advertise unlimited movies/shows/etc for similarly
| unbelievable prices.
|
| Putting aside the copyright infringement aspect of it, to me it's
| extremely obvious "wait... _why_ am I paying so little here?".
|
| No, it's not because movies and shows are 99.9999% profit
| (spoiler: they aren't), it's because you're _paying_ to install a
| backdoor that will rip and tear everything on your network it
| can.
|
| You like having a credit card? That's precious, it's mine now.
|
| Look at me, I'm the network now.
| kadoban wrote:
| > it's because you're _paying_ to install a backdoor that will
| rip and tear everything on your network it can.
|
| I mean, maybe. More likely imo you're paying for the absolute
| cheapest hardware and fastest never-updated software someone
| could throw together and make _any_ profit on. Someone probably
| had 100k shitty little chips sitting in a warehouse and this
| was a way to do something with them.
|
| The outcome is really the same, it's just the steps to get
| there are more human nature.
| BloodyIron wrote:
| At a price tag of $5/ea the cost of just advertising and
| distribution exceeds the cost of the product itself. There is
| zero room for profit. The business model is installing back
| doors to the "clients" and stealing money, information, and
| anything else from them. Consider that even the cost of the
| included remote is a huge part of the actual hardware cost,
| and nobody is going to buy something like this without a
| remote.
| GolfPopper wrote:
| >you're _paying_ to install a backdoor that will rip and tear
| everything on your network it can*
|
| How is this different from buying hardware and software from
| big market players?
| polishdude20 wrote:
| So is there some catch all setting I can enable in my router to
| prevent my devices talking to eachother on the local network?
| kadoban wrote:
| In most shitty routers: no. They don't even have raw ability to
| do that.
|
| You can look around for something like device isolation, but I
| doubt you'll find it unless you go a couple of steps up from
| whatever router ISPs ~give away these days.
| aspbee555 wrote:
| usually lan devices do not talk to the router unless they need
| a resource outside your lan network
|
| you can however isolate with vlans and a vlan capable switch,
| then it would be on the router to isolate traffic between lans
| (I do exactly this for my less trusted virtual machines)
| Nextgrid wrote:
| > to relay malicious and abusive Internet traffic -- such as _ad
| fraud_ , account takeover attempts and _mass content scraping_
|
| Oh no, let me get my tiny violin! Really hard to feel bad here.
| For most home users (that don't expose anything sensitive on
| their LAN) these boxes are not a threat, seem to be doing a
| useful service in providing a superior streaming service that the
| balkanized official ones, _and_ also shits on internet spammers
| /advertisers and frees up loginwalled content - sounds like a
| pretty good box really.
| hedora wrote:
| I'd be nice to control where the money and content go. If I
| could, I'd strongly consider firing up an old raspberry pi or
| two.
|
| Also, is there a better word than ad fraud? It needs an
| innocuous sounding euphemism like pretty much everything else
| involving that industry has. "Monetizing ad display"? "User-
| agent driven conversions?"
| cryzinger wrote:
| The actual industry lingo is "invalid traffic" :P
| cogman10 wrote:
| How hard would it be to grab one of these little virus boxes and
| flash it with linux?
___________________________________________________________________
(page generated 2026-01-05 23:00 UTC)