Android TV boxes and set-top boxes deserve a quick security check after Unit 42 identified Kimwolf v7, an Android/IoT botnet variant focused mainly on those devices. Start by checking whether Android Debug Bridge (ADB) is exposed without authentication on the local network.
Inventory every box before changing settings
List the Android TV boxes and set-top boxes connected to the network, including devices that are rarely used. Record each device’s location, owner and purpose before changing anything. A fixed inventory gives you a reference for the rest of the investigation and helps distinguish a known media device from an unfamiliar Android system.
Then check whether ADB is enabled on each device and whether port 5555 is reachable from the local network. Unit 42 reports that Kimwolf spreads by using residential proxy services to reach unauthenticated Android ADB instances on local networks. Some boxes expose ADB on port 5555, allowing installation without authentication after the proxy tunnel is established.
An exposed port is a risk signal, not proof that the box is infected. It does, however, identify a configuration that should be corrected before you spend time interpreting less certain indicators.
Disable ADB when the box does not need it
If ADB is not required for the device’s normal purpose, disable it using the device’s available settings. If the box is used for development or another task that requires ADB, keep it limited to the smallest trusted network and require authentication where the device supports it.
Do not leave an unauthenticated ADB service available simply because the box is behind a home or office connection. After changing the setting, repeat the port check so the result matches the configuration you intended to apply.
Use several indicators before calling it an infection
Kimwolf v7 does not rely on only one visible symptom. Unit 42 says the binary contains five hard-coded public Ethereum RPC endpoints to resolve ENS domains used to obtain command-and-control addresses. If ENS resolution fails, it falls back to a hard-coded Tor v3 hidden service.
All command-and-control traffic passes through a local proxy at 127.0.0[.]1:23075, regardless of whether the destination uses the clearnet or Tor. These details can support a structured investigation, but they are not a reason to treat every Tor connection or Ethereum-related lookup as malicious.
Instead, look for a combination of signals: an exposed ADB service, an unexpected application or binary, and network activity that cannot be explained by the device’s intended use. No single item in that combination should be treated as a verdict without the others and without checking the device’s role.
Account for what Kimwolf v7 adds—and removes
The variant adds an HTTP/2 DDoS flood that builds complete browser fingerprints, making its traffic harder to distinguish from legitimate browsing requests. Unit 42 also describes a dispatch table supporting 15 DDoS methods across OSI layers 3 through 7, although cases 8, 11 and 13 do not appear in the switch statement.
For a household, the practical consequence is that an infected box may affect the reliability of the local connection or participate in attacks without displaying an obvious on-screen problem. For a business or managed property, repeated outbound traffic, unexplained bandwidth use or a device that becomes unstable should prompt a comparison with the device inventory and network records.
Do not assume that older Kimwolf indicators cover this version. Compared with earlier versions, v7 removed scanning, exploitation and brute-force functions. That narrows the behavior Unit 42 attributes to this sample, but it does not make an exposed ADB service safe: the reported propagation path still targets unauthenticated Android debugging access.
Put local events on the same timeline
Unit 42 discovered the variant on February 3, 2026, during threat hunting. Its infrastructure analysis linked 22 IP addresses sharing the same SSH key between December 18, 2025, and February 3, 2026. The clustered hosts were in AS202799 and geolocated to Saint Petersburg, Russia.
Those observations describe the infrastructure examined by Unit 42; they do not establish that every connection from those locations is related to Kimwolf. Keep the dates alongside local records: an event that predates the investigation is not automatically unrelated, and an event after February 3 is not automatically Kimwolf. Device identity, ADB exposure, timing and observed behavior need to line up before a stronger conclusion is justified.
Isolate a device that raises concern
- Remove the suspected box from the network or place it in an isolated segment so it cannot continue making unexplained connections.
- Record the device details, the time of isolation and the ADB exposure observed on the network.
- Preserve relevant logs before wiping or replacing the device when an investigation may be required.
- Disable unauthenticated ADB on remaining Android TV boxes and set-top boxes, then repeat the port check.
- Reintroduce a device only after its software state and network behavior have been reviewed through the process available to the owner or administrator.
On March 19, 2026, Unit 42 reported that the U.S. Department of Justice and international partners had announced a court-authorized operation that seized command-and-control infrastructure used by the Aisuru, KimWolf, JackSkid and Mossad botnets. That action is important context, but it is not a substitute for checking local devices.
Unit 42 also identified eth[.]rpcuniverse[.]com as a sixth RPC endpoint assessed with moderate confidence as operator-controlled, while noting that domain ownership could not be confirmed. Treat that finding as an investigative lead rather than a standalone confirmation.
The immediate decision is clear: fix unauthenticated ADB on Android TV boxes and set-top boxes, then investigate any remaining unexplained behavior using the device inventory, timing and network evidence. Kimwolf v7’s DDoS capabilities and layered command-and-control design make the first check worthwhile, while the limits in Unit 42’s infrastructure findings show why one indicator should not decide the outcome.