- \n
- For the end user<\/strong>: constant slowness on the internet, total consumption of available bandwidth, router or ONU at the limit (CPU at 100%), generating enormous dissatisfaction and risk of churn (loss of customers); <\/li>\n\n\n\n
- For the ISP<\/strong>: bandwidth consumed unnecessarily, overload on BNGs and CGNATs, increased use of backbone circuits, crowded call-center with complaints without a quick solution and high operating costs; <\/li>\n\n\n\n
- For third parties<\/strong>: whose networks are attacked, crimes facilitated by anonymous browsing via a home proxy. <\/li>\n<\/ul>\n\n
RESULT<\/strong>: frustrated customers, high support costs and reputational risk for the entire ISP. A vicious circle that nobody wants and that is growing fast. <\/p>\n\n
REAL CHAOS!<\/h4>\n\n
Below is a compilation of questions and answers to what we already know about the subject. And at the end some tips on how to protect or mitigate yourself. <\/p>\n\n
1) Where is this attack coming from and why?<\/strong> <\/h2>\n\n
According to security websites Xlab and Synthient, the actors involved in the botnet use it to make money from certain types of service: <\/p>\n\n
- \n
- Private Browsing via Proxy-Residential<\/li>\n\n\n\n
- Targeted Data Attacks<\/li>\n\n\n\n
- Installing third-party apps<\/li>\n<\/ul>\n\n
Since they have complete control of all the devices, they use the command-control servers to create browsing tunnels, install apps and launch DDoS attacks against third parties. There have also been reports of things beyond security, such as passing on images and videos of controversial subjects (political, geo-political, etc.). <\/p>\n\n
2) Are there already a lot of people infected?<\/strong><\/h2>\n\n
Data from Synthient and XLab indicate that, although this represents only a fraction of all communications, there were more than 12 million unique IP addresses (estimated to represent about 2 million devices). Most of them come from Brazil (~15%), followed by Vietnam, India, the U.S., and Argentina. <\/p>\n\n
![\"\"](\"https:\/\/made4it.com.br\/wp-content\/uploads\/2026\/01\/image.png\")
<\/figure>\n\nThe Chinese security company XLab identified that the Kimwolf botnet had compromised between 1.8 and 2 million devices, with a strong concentration in Brazil, India, the United States and Argentina.<\/em>
3) How is the equipment infected?<\/strong><\/h2>\n\n
You’ve probably wondered how this equipment can be so cheap, right? That’s right. <\/p>\n\n
![\"\"](\"https:\/\/made4it.com.br\/wp-content\/uploads\/2026\/01\/image-1.png\")
<\/figure>\n\n\n
Some images of devices that are already infected. Source: Synthient. <\/em><\/p>\n<\/blockquote>\n\n
It has also been found that they do not undergo a rigorous process of vulnerability fixes, security patches, and updates\/improvements. This is a goldmine for criminals. <\/p>\n\n
The main way Kimwolf is infected is by exploiting a flaw in the SDKs of residential proxy applications (such as Byteconnect, IPIDEA and PYPROXY). The attacker rents a legitimate proxy from these services, uses the tunnel to “go back” through the device’s own connection and access the internal local network where he finds the ADB (Android Debug Bridge) exposed without authentication (port 5555 and similar). <\/p>\n\n
In seconds, it sends remote commands, downloads the malware and installs everything.<\/strong><\/p>\n\n
![\"\"](\"https:\/\/made4it.com.br\/wp-content\/uploads\/2026\/01\/image-2.png\")
<\/figure>\n\n\n
Residential proxy infection topology. Source: Synthient. <\/em><\/p>\n<\/blockquote>\n\n
There are a number of ways in which equipment can be infected (but they all end up converging on this main mechanism):<\/p>\n\n
1\u00ba) From the factory<\/strong><\/h3>\n\n
Many devices leave the factory with proxy-residential applications pre-installed (without the user knowing), in order to monetize the bandwidth later. When the device enters the proxy pool (e.g. IPIDEA, Byteconnect, PYPROXY), the attacker exploits exactly this open port.
2\u00ba) By installing unreliable apps<\/strong><\/h3>\n\n
Users install third-party (unverified) applications, and these silently add the proxy SDK, activating the exploit path via ADB.<\/p>\n\n
3\u00ba) Vulnerable ADB\/Telnet ports<\/strong><\/h3>\n\n
Some of these IPTVs already come with ADB exposed by default. Even without the initial SDK, a small scan\/brute force on ports such as 5555, 3222 or 5858 allows shell access and installation of the malware. <\/p>\n\n
4) What are these proxy apps?<\/strong><\/h2>\n\n
Basically, they are companies that sell internet browsing through their “proxies” around the world. When you buy a service from them, you set up a “VPN” to their servers, and then your browsing goes through the chosen package (for example, browsing through residential IPs in Brazil, Vietnam, etc.). They make money by charging a few dollars per GB of traffic. <\/p>\n\n
But what to do?<\/strong><\/h3>\n\n
If you want an easy answer, you won’t get it. We’re going to have to tackle this problem on several fronts. After all, unlike other botnets where the device was in the ISP’s control (the router, the UN, etc), in this case the infected equipment in 99% of cases is the customer’s own. <\/p>\n\n
From an ISP perspective, we can tackle the problem in 4 actions:<\/strong><\/p>\n\n
![\"\"](\"https:\/\/made4it.com.br\/wp-content\/uploads\/2026\/01\/image-3.png\")
<\/figure>\n\nAction 1: identify offending customers\/equipment<\/strong><\/h3>\n\n
On Synthient’s github (the link will be further down), there is a fraction of the list of IPs\/ports used in the botnet. But they are already the first step towards identification. <\/p>\n\n
Use this list and compare it with the communications in your netflow software (preferably made4flow), coming from your BNG.<\/p>\n\n
With this, you will already know who is infected internally.<\/p>\n\n
Action 2: mitigate \/ circumvent impacts<\/strong><\/h3>\n\n
This is where technical creativity comes in.<\/p>\n\n
The basic thing is to block communications through a firewall or blackhole (but these don’t last long and serve at most as a band-aid – because the botnet is just as capable of changing IPs\/networks as pirate TVs are of bypassing Anatel’s blocks).<\/p>\n\n
Once this is done, start thinking about more elaborate solutions.<\/p>\n\n
- \n
- control of the number of connections for each client;<\/li>\n\n\n\n
- dynamic flowspec rules to drop malicious traffic (made4flow can help);<\/li>\n\n\n\n
- implement NGFW to deal with the universe of infected clients (we can do this automatically, huh?);<\/li>\n\n\n\n
- move the infected clients to a quarantine network (which will not affect the others);<\/li>\n<\/ul>\n\n
If you need help, call us!<\/strong><\/p>\n\n
Action 3: fix infected equipment<\/strong><\/h3>\n\n
The recommendations of security websites are: destroy these devices. Period. <\/p>\n\n
But we know the reality. You can’t destroy a customer’s device, but you can work on raising awareness. Develop a script, play your cards right and go visit your client. Show them how their network is being used to commit crimes. Show them the sites, the articles. <\/p>\n\n
Try updating, resetting, removing suspicious applications.<\/p>\n\n
Use the website https:\/\/synthient.com\/check<\/a> to show the customer that they have been caught in the botnet scans.<\/p>\n\n
Action 4: implement constant monitoring<\/strong><\/h3>\n\n
- \n
- Be aware of the security websites that deal with the subject;<\/li>\n\n\n\n
- Update your block list constantly;<\/li>\n\n\n\n
- Constantly, and preferably automatically, check your network for suspicious communications;<\/li>\n\n\n\n
- Observe clients uploading to many different IPs – this could be a sign of compromise;<\/li>\n\n\n\n
- Monitor DNS queries for suspicious domains (even if they also use DoT and ENS);<\/li>\n\n\n\n
- Good netflow software can help. Count on made4flow for this monitoring. <\/li>\n<\/ul>\n\n
If you’re dealing with this in your network and want to exchange ideas about filters, PBR or automatic monitoring, send me a message or comment here. <\/p>\n\n
We are helping several ISPs to map and isolate these devices without extra headaches.<\/strong><\/p>\n\n\n I NEED HELP\n<\/a>\n\n
#Cybersecurity #DDoS #Botnet #ISP #Kimwolf #InternetServiceProvider #DigitalSecurity<\/strong><\/p>\n\n
Article references<\/p>\n\n
https:\/\/synthient.com\/blog\/a-broken-system-fueling-botnets<\/a>
<\/p>\n","protected":false},"excerpt":{"rendered":"
Once again, ISP networks are under attack… but now the enemy comes from within. Have you ever seen the call center explode with complaints of unexplained slowness? We’ve barely recovered from the attack that exploited vulnerabilities in the Realtek SDK where routers and ONUs were compromised and used for DDoS against third parties, and we’re already dealing with a much more dangerous and widespread threat: the AISURU\/Kimwolf botnet. This botnet mainly exploits cheap Android IPTV, SmartTV and set-top-box devices installed in users’ homes. These devices become zombies that sell home proxies and, to a lesser extent, participate in DDoS attacks on third parties. The result? Widespread problems on several fronts: RESULT: frustrated customers, high support costs and reputational risk for the entire ISP. A vicious circle that nobody wants and that is growing fast. REAL CHAOS! Below is a compilation of questions and answers to what we already know about the subject. And at the end some tips on how to protect or mitigate yourself. 1) Where is this attack coming from and why? According to security websites Xlab and Synthient, the actors involved in the botnet use it to make money from certain types of service: Since they have complete control of all the devices, they use the command-control servers to create browsing tunnels, install apps and launch DDoS attacks against third parties. There have also been reports of things beyond security, such as passing on images and videos of controversial subjects (political, geo-political, etc.). 2) Are there already a lot of people infected? Data from Synthient and XLab indicate that, although this represents only a fraction of all communications, there were more than 12 million unique IP addresses (estimated to represent about 2 million devices). Most of them come from Brazil (~15%), followed by Vietnam, India, the U.S., and Argentina. The Chinese security company XLab identified that the Kimwolf botnet had compromised between 1.8 and 2 million devices, with a strong concentration in Brazil, India, the United States and Argentina. Image: blog.xLab.qianxin.com 3) How is the equipment infected? You’ve probably wondered how this equipment can be so cheap, right? That’s right. Some images of devices that are already infected. Source: Synthient. It has also been found that they do not undergo a rigorous process of vulnerability fixes, security patches, and updates\/improvements. This is a goldmine for criminals. The main way Kimwolf is infected is by exploiting a flaw in the SDKs of residential proxy applications (such as Byteconnect, IPIDEA and PYPROXY). The attacker rents a legitimate proxy from these services, uses the tunnel to “go back” through the device’s own connection and access the internal local network where he finds the ADB (Android Debug Bridge) exposed without authentication (port 5555 and similar). In seconds, it sends remote commands, downloads the malware and installs everything. Residential proxy infection topology. Source: Synthient. There are a number of ways in which equipment can be infected (but they all end up converging on this main mechanism): 1\u00ba) From the factory Many devices leave the factory with proxy-residential applications pre-installed (without the user knowing), in order to monetize the bandwidth later. When the device enters the proxy pool (e.g. IPIDEA, Byteconnect, PYPROXY), the attacker exploits exactly this open port.This is the main way of infection and this is how the Kimwolf botnet spread the most, with millions of compromised devices in months. 2\u00ba) By installing unreliable apps Users install third-party (unverified) applications, and these silently add the proxy SDK, activating the exploit path via ADB. 3\u00ba) Vulnerable ADB\/Telnet ports Some of these IPTVs already come with ADB exposed by default. Even without the initial SDK, a small scan\/brute force on ports such as 5555, 3222 or 5858 allows shell access and installation of the malware. 4) What are these proxy apps? Basically, they are companies that sell internet browsing through their “proxies” around the world. When you buy a service from them, you set up a “VPN” to their servers, and then your browsing goes through the chosen package (for example, browsing through residential IPs in Brazil, Vietnam, etc.). They make money by charging a few dollars per GB of traffic. But what to do? If you want an easy answer, you won’t get it. We’re going to have to tackle this problem on several fronts. After all, unlike other botnets where the device was in the ISP’s control (the router, the UN, etc), in this case the infected equipment in 99% of cases is the customer’s own. From an ISP perspective, we can tackle the problem in 4 actions: Action 1: identify offending customers\/equipment On Synthient’s github (the link will be further down), there is a fraction of the list of IPs\/ports used in the botnet. But they are already the first step towards identification. Use this list and compare it with the communications in your netflow software (preferably made4flow), coming from your BNG. With this, you will already know who is infected internally. Action 2: mitigate \/ circumvent impacts This is where technical creativity comes in. The basic thing is to block communications through a firewall or blackhole (but these don’t last long and serve at most as a band-aid – because the botnet is just as capable of changing IPs\/networks as pirate TVs are of bypassing Anatel’s blocks). Once this is done, start thinking about more elaborate solutions. If you need help, call us! Action 3: fix infected equipment The recommendations of security websites are: destroy these devices. Period. But we know the reality. You can’t destroy a customer’s device, but you can work on raising awareness. Develop a script, play your cards right and go visit your client. Show them how their network is being used to commit crimes. Show them the sites, the articles. Try updating, resetting, removing suspicious applications. Use the website https:\/\/synthient.com\/check to show the customer that they have been caught in the botnet scans. Action 4: implement constant monitoring If you’re dealing with this in your network and want to exchange ideas about filters,<\/p>\n","protected":false},"author":5,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1337,1338,869,1304],"tags":[1340,1339,1341,1343,1342],"class_list":["post-18795","post","type-post","status-publish","format-standard","hentry","category-ddos","category-firewall","category-network","category-settings","tag-botnet","tag-ddos","tag-kimwolf","tag-mitigate","tag-mitigation"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t
- For the ISP<\/strong>: bandwidth consumed unnecessarily, overload on BNGs and CGNATs, increased use of backbone circuits, crowded call-center with complaints without a quick solution and high operating costs; <\/li>\n\n\n\n