The story you are reading is a series of scoops nestled inside a far more urgent Internet-wide security advisory. The vulnerability at issue has been exploited for months already, and it\u2019s time for a broader awareness of the threat. The short version is that everything you thought you knew about the security of the internal network behind your Internet router probably is now dangerously out of date.<\/p>\n
![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2026\/01\/synthient-kimwolfmap.png?resize=1613%2C782&ssl=1\")
<\/p>\nThe security company Synthient currently sees more than 2 million infected Kimwolf devices distributed globally but with concentrations in Vietnam, Brazil, India, Saudi Arabia, Russia and the United States. Synthient found that two-thirds of the Kimwolf infections are Android TV boxes with no security or authentication built in.<\/p>\n<\/div>\n
The past few months have witnessed the explosive growth of a new botnet dubbed Kimwolf<\/strong>, which experts say has infected more than 2 million devices globally. The Kimwolf malware forces compromised systems to relay malicious and abusive Internet traffic \u2014 such as ad fraud, account takeover attempts and mass content scraping \u2014 and participate in crippling distributed denial-of-service (DDoS) attacks capable of knocking nearly any website offline for days at a time.<\/p>\n More important than Kimwolf\u2019s staggering size, however, is the diabolical method it uses to spread so quickly: By effectively tunneling back through various \u201cresidential proxy<\/a>\u201d networks and into the local networks of the proxy endpoints, and by further infecting devices that are hidden behind the assumed protection of the user\u2019s firewall and Internet router.<\/p>\n Residential proxy networks are sold as a way for customers to anonymize and localize their Web traffic to a specific region, and the biggest of these services allow customers to route their traffic through devices in virtually any country or city around the globe.<\/p>\n The malware that turns an end-user\u2019s Internet connection into a proxy node is often bundled with dodgy mobile apps and games. These residential proxy programs also are commonly installed via unofficial Android TV boxes<\/strong>\u00a0sold by third-party merchants on popular e-commerce sites like Amazon<\/strong>, BestBuy, Newegg<\/strong>, and Walmart<\/strong>.<\/p>\n These TV boxes range in price from $40 to $400, are marketed under a dizzying range of no-name brands and model numbers<\/a>, and frequently are advertised as a way to stream certain types of subscription video content for free<\/em>. But there\u2019s a hidden cost to this transaction: As we\u2019ll explore in a moment, these TV boxes make up a considerable chunk of the estimated two million systems currently infected with Kimwolf.<\/p>\n Some of the unsanctioned Android TV boxes that come with residential proxy malware pre-installed. Image: Synthient.<\/p>\n<\/div>\n Kimwolf also is quite good at infecting a range of Internet-connected digital photo frames that likewise are abundant at major e-commerce websites. In November 2025, researchers from Quokka<\/strong> published a report<\/a> (PDF) detailing serious security issues in Android-based digital picture frames running the Uhale app \u2014 <\/strong>including Amazon\u2019s bestselling digital frame as of March 2025.<\/p>\n There are two major security problems with these photo frames and unofficial Android TV boxes. The first is that a considerable percentage of them come with malware pre-installed, or else require the user to download an unofficial Android App Store and malware in order to use the device for its stated purpose (video content piracy). The most typical of these uninvited guests are small programs that turn the device into a residential proxy node that is resold to others.<\/p>\n The second big security nightmare with these photo frames and unsanctioned Android TV boxes is that they rely on a handful of Internet-connected microcomputer boards that have no discernible security or authentication requirements built-in. In other words, if you are on the same network as one or more of these devices, you can likely compromise them simultaneously by issuing a single command across the network.<\/p>\n The combination of these two security realities came to the fore in October 2025, when an undergraduate computer science student at the Rochester Institute of Technology<\/strong> began closely tracking Kimwolf\u2019s growth, and interacting directly with its apparent creators on a daily basis.<\/p>\n Benjamin Brundage <\/strong>is the 22-year-old founder of the security firm Synthient<\/strong>, a startup that helps companies detect proxy networks and learn how those networks are being abused. Conducting much of his research into Kimwolf while studying for final exams, Brundage told KrebsOnSecurity in late October 2025 he suspected Kimwolf was a new Android-based variant of Aisuru<\/strong>, a botnet that was incorrectly blamed<\/a> for a number of record-smashing DDoS attacks last fall.<\/p>\n Brundage says Kimwolf grew rapidly by abusing a glaring vulnerability in many of the world\u2019s largest residential proxy services. The crux of the weakness, he explained, was that these proxy services weren\u2019t doing enough to prevent their customers from forwarding requests to internal servers of the individual proxy endpoints.<\/p>\n Most proxy services take basic steps to prevent their paying customers from \u201cgoing upstream\u201d into the local network of proxy endpoints, by explicitly denying requests for local addresses specified in RFC-1918<\/a>, including the well-known Network Address Translation<\/a> (NAT) ranges 10.0.0.0\/8, 192.168.0.0\/16, and 172.16.0.0\/12. These ranges allow multiple devices in a private network to access the Internet using a single public IP address, and if you run any kind of home or office network, your internal address space operates within one or more of these NAT ranges.<\/p>\n However, Brundage discovered that the people operating Kimwolf had figured out how to talk directly to devices on the internal networks of millions of residential proxy endpoints, simply by changing their Domain Name System<\/strong> (DNS) settings to match those in the RFC-1918 address ranges.<\/p>\n \u201cIt is possible to circumvent existing domain restrictions by using DNS records that point to 192.168.0.1 or 0.0.0.0,\u201d Brundage wrote in a first-of-its-kind security advisory sent to nearly a dozen residential proxy providers in mid-December 2025. \u201cThis grants an attacker the ability to send carefully crafted requests to the current device or a device on the local network. This is actively being exploited, with attackers leveraging this functionality to drop malware.\u201d<\/p>\n As with the digital photo frames mentioned above, many of these residential proxy services run solely on mobile devices that are running some game, VPN or other app with a hidden component that turns the user\u2019s mobile phone into a residential proxy \u2014 often without any meaningful consent.<\/p>\n In a report published today<\/a>, Synthient said key actors involved in Kimwolf were observed monetizing the botnet through app installs, selling residential proxy bandwidth, and selling its DDoS functionality.<\/p>\n \u201cSynthient expects to observe a growing interest among threat actors in gaining unrestricted access to proxy networks to infect devices, obtain network access, or access sensitive information,\u201d the report observed. \u201cKimwolf highlights the risks posed by unsecured proxy networks and their viability as an attack vector.\u201d<\/p>\n After purchasing a number of unofficial Android TV box models that were most heavily represented in the Kimwolf botnet, Brundage further discovered the proxy service vulnerability was only part of the reason for Kimwolf\u2019s rapid rise: He also found virtually all of the devices he tested were shipped from the factory with a powerful feature called Android Debug Bridge<\/strong> (ADB) mode enabled by default.<\/p>\n Many of the unofficial Android TV boxes infected by Kimwolf include the ominous disclaimer: \u201cMade in China. Overseas use only.\u201d Image: Synthient.<\/p>\n<\/div>\n ADB is a diagnostic tool intended for use solely during the manufacturing and testing processes, because it allows the devices to be remotely configured and even updated with new (and potentially malicious) firmware. However, shipping these devices with ADB turned on creates a security nightmare because in this state they constantly listen for and accept unauthenticated connection requests.<\/p>\n For example, opening a command prompt and typing \u201cadb connect\u201d along with a vulnerable device\u2019s (local) IP address followed immediately by \u201c:5555\u201d will very quickly offer unrestricted \u201csuper user\u201d administrative access.<\/p>\n Brundage said by early December, he\u2019d identified a one-to-one overlap between new Kimwolf infections and proxy IP addresses offered for rent by China-based IPIDEA<\/strong>, currently the world\u2019s largest residential proxy network by all accounts.<\/p>\n \u201cKimwolf has almost doubled in size this past week, just by exploiting IPIDEA\u2019s proxy pool,\u201d Brundage told KrebsOnSecurity in early December as he was preparing to notify IPIDEA and 10 other proxy providers about his research.<\/p>\n Brundage said Synthient first confirmed on December 1, 2025 that the Kimwolf botnet operators were tunneling back through IPIDEA\u2019s proxy network and into the local networks of systems running IPIDEA\u2019s proxy software. The attackers dropped the malware payload by directing infected systems to visit a specific Internet address and to call out the pass phrase \u201ckrebsfiveheadindustries<\/strong>\u201d in order to unlock the malicious download.<\/p>\n On December 30, Synthient said it was tracking roughly 2 million IPIDEA addresses exploited by Kimwolf in the previous week. Brundage said he has witnessed Kimwolf rebuilding itself after one recent takedown effort targeting its control servers \u2014 from almost nothing to two million infected systems just by tunneling through proxy endpoints on IPIDEA for a couple of days.<\/p>\n Brundage said IPIDEA has a seemingly inexhaustible supply of new proxies, advertising\u00a0access to more than 100 million residential proxy endpoints around the globe in the past week alone<\/em>. Analyzing the exposed devices that were part of IPIDEA\u2019s proxy pool, Synthient said it found more than two-thirds were Android devices that could be compromised with no authentication needed<\/em>.<\/p>\n After charting a tight overlap in Kimwolf-infected IP addresses and those sold by IPIDEA, Brundage was eager to make his findings public: The vulnerability had clearly been exploited for several months, although it appeared that only a handful of cybercrime actors were aware of the capability. But he also knew that going public without giving vulnerable proxy providers an opportunity to understand and patch it would only lead to more mass abuse of these services by additional cybercriminal groups.<\/p>\n On December 17, Brundage sent a security notification to all 11 of the apparently affected proxy providers, hoping to give each at least a few weeks to acknowledge and address the core problems identified in his report before he went public. Many proxy providers who received the notification were resellers of IPIDEA that white-labeled the company\u2019s service.<\/p>\n KrebsOnSecurity first sought comment from IPIDEA in October 2025, in reporting on a story about how the proxy network appeared to have benefitted from the rise of the Aisuru botnet<\/a>, whose administrators appeared to shift from using the botnet primarily for DDoS attacks to simply installing IPIDEA\u2019s proxy program, among others.<\/p>\n On December 25, KrebsOnSecurity received an email from an IPIDEA employee identified only as \u201cOliver<\/strong>,\u201d who said allegations that IPIDEA had benefitted from Aisuru\u2019s rise were baseless.<\/p>\n \u201cAfter comprehensively verifying IP traceability records and supplier cooperation agreements, we found no association between any of our IP resources and the Aisuru botnet, nor have we received any notifications from authoritative institutions regarding our IPs being involved in malicious activities,\u201d Oliver wrote. \u201cIn addition, for external cooperation, we implement a three-level review mechanism for suppliers, covering qualification verification, resource legality authentication and continuous dynamic monitoring, to ensure no compliance risks throughout the entire cooperation process.\u201d<\/p>\n \u201cIPIDEA firmly opposes all forms of unfair competition and malicious smearing in the industry, always participates in market competition with compliant operation and honest cooperation, and also calls on the entire industry to jointly abandon irregular and unethical behaviors and build a clean and fair market ecosystem,\u201d Oliver continued.<\/p>\n Meanwhile, the same day that Oliver\u2019s email arrived, Brundage shared a response he\u2019d just received from IPIDEA\u2019s security officer, who identified himself only by the first name Byron<\/strong>. The security officer said IPIDEA had made a number of important security changes to its residential proxy service to address the vulnerability identified in Brundage\u2019s report.<\/p>\n \u201cBy design, the proxy service does not allow access to any internal or local address space,\u201d Byron explained. \u201cThis issue was traced to a legacy module used solely for testing and debugging purposes, which did not fully inherit the internal network access restrictions. Under specific conditions, this module could be abused to reach internal resources. The affected paths have now been fully blocked and the module has been taken offline.\u201d<\/p>\n Byron told Brundage IPIDEA also instituted multiple mitigations for blocking DNS resolution to internal (NAT) IP ranges, and that it was now blocking proxy endpoints from forwarding traffic on \u201chigh-risk\u201d ports \u201cto prevent abuse of the service for scanning, lateral movement, or access to internal services.\u201d<\/p>\n An excerpt from an email sent by IPIDEA\u2019s security officer in response to Brundage\u2019s vulnerability notification. Click to enlarge.<\/p>\n<\/div>\n Brundage said IPIDEA appears to have successfully patched the vulnerabilities he identified. He also noted he never observed the Kimwolf actors targeting proxy services other than IPIDEA, which has not responded to requests for comment.<\/p>\n <\/span><\/p>\n Riley Kilmer<\/strong> is founder of Spur.us<\/a>, a technology firm that helps companies identify and filter out proxy traffic. Kilmer said Spur has tested Brundage\u2019s findings and confirmed that IPIDEA and all of its affiliate resellers indeed allowed full and unfiltered access to the local LAN.<\/p>\n Kilmer said one model of unsanctioned Android TV boxes that is especially popular \u2014 the Superbox,<\/strong> which we profiled in November\u2019s Is Your Android TV Streaming Box Part of a Botnet?<\/a> \u2014 leaves Android Debug Mode running on localhost:5555.<\/p>\n \u201cAnd since Superbox turns the IP into an IPIDEA proxy, a bad actor just has to use the proxy to localhost on that port and install whatever bad SDKs [software development kits] they want,\u201d Kilmer told KrebsOnSecurity.<\/p>\n Superbox media streaming boxes for sale on Walmart.com.<\/p>\n<\/div>\n Both Brundage and Kilmer say IPIDEA appears to be the second or third reincarnation of a residential proxy network formerly known as 911S5 Proxy<\/strong>, a service that operated between 2014 and 2022 and was wildly popular on cybercrime forums. 911S5 Proxy imploded<\/a> a week after KrebsOnSecurity published a deep dive on the service\u2019s sketchy origins and leadership<\/a> in China.<\/p>\n In that 2022 profile, we cited work by researchers at the University of Sherbrooke<\/strong> in Canada who were studying the threat 911S5 could pose to internal corporate networks. The researchers noted that \u201cthe infection of a node enables the 911S5 user to access shared resources on the network such as local intranet portals or other services.\u201d<\/p>\n \u201cIt also enables the end user to probe the LAN network of the infected node,\u201d the researchers explained<\/a>. \u201cUsing the internal router, it would be possible to poison the DNS cache of the LAN router of the infected node, enabling further attacks.\u201d<\/p>\n 911S5 initially responded to our reporting in 2022 by claiming it was conducting a top-down security review of the service. But the proxy service abruptly closed up shop just one week later, saying a malicious hacker had destroyed all of the company\u2019s customer and payment records. In July 2024, The U.S. Department of the Treasury<\/strong> sanctioned the alleged creators of 911S5<\/a>, and the U.S. Department of Justice<\/strong> arrested the Chinese national named in my 2022 profile of the proxy service.<\/p>\n Kilmer said IPIDEA also operates a sister service called 922 Proxy<\/strong>, which the company has pitched from Day One as a seamless alternative to 911S5 Proxy.<\/p>\n \u201cYou cannot tell me they don\u2019t want the 911 customers by calling it that,\u201d Kilmer said.<\/p>\n Among the recipients of Synthient\u2019s notification was the proxy giant Oxylabs<\/strong>. Brundage shared an email he received from Oxylabs\u2019 security team on December 31, which acknowledged Oxylabs had started rolling out security modifications to address the vulnerabilities described in Synthient\u2019s report.<\/p>\n Reached for comment, Oxylabs confirmed they \u201chave implemented changes that now eliminate the ability to bypass the blocklist and forward requests to private network addresses using a controlled domain,\u201d the company said in a written statement. But it said there is no evidence that Kimwolf or other other attackers exploited its network.<\/p>\n \u201cIn parallel, we reviewed the domains identified in the reported exploitation activity and did not observe traffic associated with them,\u201d the Oxylabs statement continued. \u201cBased on this review, there is no indication that our residential network was impacted by these activities.\u201d<\/p>\n Consider the following scenario, in which the mere act of allowing someone to use your Wi-Fi network could lead to a Kimwolf botnet infection. In this example, a friend or family member comes to stay with you for a few days, and you grant them access to your Wi-Fi without knowing that their mobile phone is infected with an app that turns the device into a residential proxy node. At that point, your home\u2019s public IP address will show up for rent at the website of some residential proxy provider.<\/p>\n Miscreants like those behind Kimwolf then use residential proxy services online to access that proxy node on your IP, tunnel back through it and into your local area network (LAN), and automatically scan the internal network for devices with Android Debug Bridge mode turned on.<\/p>\n By the time your guest has packed up their things, said their goodbyes and disconnected from your Wi-Fi, you now have two devices on your local network \u2014 a digital photo frame and an unsanctioned Android TV box \u2014 that are infected with Kimwolf. You may have never intended for these devices to be exposed to the larger Internet, and yet there you are.<\/p>\n Here\u2019s another possible nightmare scenario: Attackers use their access to proxy networks to modify your Internet router\u2019s settings so that it relies on malicious DNS servers controlled by the attackers \u2014 allowing them to control where your Web browser goes when it requests a website. Think that\u2019s far-fetched? Recall the DNSChanger malware from 2012<\/a> that infected more than a half-million routers with search-hijacking malware, and ultimately spawned an entire security industry working group focused on containing and eradicating it.<\/p>\n Much of what is published so far on Kimwolf has come from the Chinese security firm XLab<\/strong>, which was the first to chronicle the rise of the Aisuru botnet<\/a> in late 2024. In its latest blog post<\/a>, XLab said it began tracking Kimwolf on October 24, when the botnet\u2019s control servers were swamping Cloudflare\u2019s DNS servers with lookups for the distinctive domain 14emeliaterracewestroxburyma02132[.]su.<\/p>\n This domain and others connected to early Kimwolf variants spent several weeks topping Cloudflare\u2019s chart of the Internet\u2019s most sought-after domains<\/a>, edging out Google.com and Apple.com of their rightful spots in the top 5 most-requested domains. That\u2019s because during that time Kimwolf was asking its millions of bots to check in frequently using Cloudflare\u2019s DNS servers.<\/p>\n The Chinese security firm XLab found the Kimwolf botnet had enslaved between 1.8 and 2 million devices, with heavy concentrations in Brazil, India, The United States of America and Argentina. Image: blog.xLab.qianxin.com<\/p>\n<\/div>\n It is clear from reading the XLab report that KrebsOnSecurity (and security experts) probably erred in misattributing some of Kimwolf\u2019s early activities<\/a> to the Aisuru botnet, which appears to be operated by a different group entirely. IPDEA may have been truthful when it said it had no affiliation with the Aisuru botnet, but Brundage\u2019s data left no doubt that its proxy service clearly was being massively abused by Aisuru\u2019s Android variant, Kimwolf.<\/p>\n XLab said Kimwolf has infected at least 1.8 million devices, and has shown it is able to rebuild itself quickly from scratch.<\/p>\n \u201cAnalysis indicates that Kimwolf\u2019s primary infection targets are TV boxes deployed in residential network environments,\u201d XLab researchers wrote. \u201cSince residential networks usually adopt dynamic IP allocation mechanisms, the public IPs of devices change over time, so the true scale of infected devices cannot be accurately measured solely by the quantity of IPs. In other words, the cumulative observation of 2.7 million IP addresses does not equate to 2.7 million infected devices.\u201d<\/p>\n XLab said measuring Kimwolf\u2019s size also is difficult because infected devices are distributed across multiple global time zones. \u201cAffected by time zone differences and usage habits (e.g., turning off devices at night, not using TV boxes during holidays, etc.), these devices are not online simultaneously, further increasing the difficulty of comprehensive observation through a single time window,\u201d the blog post observed.<\/p>\n XLab noted that the Kimwolf author \u201cshows an almost \u2018obsessive\u2019 fixation on Yours Truly, apparently leaving \u201ceaster eggs\u201d related to my name in multiple places through the botnet\u2019s code and communications:<\/p>\n Image: XLAB.<\/p>\n<\/div>\n One frustrating aspect of threats like Kimwolf is that in most cases it is not easy for the average user to determine if there are any devices on their internal network which may be vulnerable to threats like Kimwolf and\/or already infected with residential proxy malware.<\/p>\n Let\u2019s assume that through years of security training or some dark magic you can successfully identify that residential proxy activity on your internal network was linked to a specific mobile device inside your house: From there, you\u2019d still need to isolate and remove the app or unwanted component that is turning the device into a residential proxy.<\/p>\n Also, the tooling and knowledge needed to achieve this kind of visibility just isn\u2019t there from an average consumer standpoint. The work that it takes to configure your network so you can see and interpret logs of all traffic coming in and out is largely beyond the skillset of most Internet users (and, I\u2019d wager, many security experts). But it\u2019s a topic worth exploring in an upcoming story.<\/p>\n Happily, Synthient has erected a page on its website<\/a> that will state whether a visitor\u2019s public Internet address was seen among those of Kimwolf-infected systems. Brundage also has compiled a list of the unofficial Android TV boxes<\/a> that are most highly represented in the Kimwolf botnet.<\/p>\n If you own a TV box that matches one of these model names and\/or numbers, please just rip it out of your network. If you encounter one of these devices on the network of a family member or friend, send them a link to this story and explain that it\u2019s not worth the potential hassle and harm created by keeping them plugged in.<\/p>\n The top 15 product devices represented in the Kimwolf botnet, according to Synthient.<\/p>\n<\/div>\n Chad Seaman<\/strong> is a principal security researcher with Akamai Technologies<\/strong>. Seaman said he wants more consumers to be wary of these pseudo Android TV boxes to the point where they avoid them altogether.<\/p>\n \u201cI want the consumer to be paranoid of these crappy devices and of these residential proxy schemes,\u201d he said. \u201cWe need to highlight why they\u2019re dangerous to everyone and to the individual. The whole security model where people think their LAN (Local Internal Network) is safe, that there aren\u2019t any bad guys on the LAN so it can\u2019t be that dangerous is just really outdated now.\u201d<\/p>\n \u201cThe idea that an app can enable this type of abuse on my network and other networks, that should really give you pause,\u201d about which devices to allow onto your local network, Seaman said. \u201cAnd it\u2019s not just Android devices here. Some of these proxy services have SDKs for Mac and Windows, and the iPhone. It could be running something that inadvertently cracks open your network and lets countless random people inside.\u201d<\/p>\n In July 2025, Google filed a \u201cJohn Doe\u201d\u00a0lawsuit<\/a> (PDF) against 25 unidentified defendants collectively dubbed the \u201cBadBox 2.0 Enterprise<\/strong>,\u201d which Google described as a botnet of over ten million unsanctioned Android streaming devices engaged in advertising fraud. Google said the BADBOX 2.0 botnet, in addition to compromising multiple types of devices prior to purchase, also can infect devices by requiring the download of malicious apps from unofficial marketplaces.<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/u-androidtv-kimwolf.png?resize=746%2C427&ssl=1\")
<\/a><\/p>\nTHERE\u2019S NO PLACE LIKE 127.0.0.1<\/h2>\n
ANDROID DEBUG BRIDGE<\/h2>\n
![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/china-overseasuseonly.png?resize=651%2C611&ssl=1\")
<\/p>\nSECURITY NOTIFICATION AND RESPONSE<\/h2>\n
![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/ipidea-byron.png?resize=749%2C366&ssl=1\")
<\/a><\/p>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/11\/superbox-walmart.png?resize=747%2C405&ssl=1\")
<\/p>\nECHOES FROM THE PAST<\/h2>\n
PRACTICAL IMPLICATIONS<\/h2>\n
XLAB<\/h2>\n
![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/xlab-countrykimwolf.png?resize=747%2C798&ssl=1\")
<\/p>\n![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/xlab-kimwolfk.png?resize=735%2C702&ssl=1\")
<\/p>\nANALYSIS AND ADVICE<\/h2>\n
![\"\"](\"https:\/\/i0.wp.com\/krebsonsecurity.com\/wp-content\/uploads\/2025\/12\/synthient-topproductdevices.png?resize=750%2C372&ssl=1\")
<\/p>\n