[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEIMq9djEH5AGsIZdEnYrp1CaHcnFQFhdnm_SHGqmBL0":3},{"article":4,"iocs":50,"watch_terms":57,"solutions":58,"lesson":154},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"6b18c460-18a9-4d49-b898-6c06d7db795e","Kimwolf botnet rebuilt to survive takedowns, researchers say","kimwolf-botnet-rebuilt-to-survive-takedowns-researchers-say-e71bdc","Months after police seized its servers and arrested an alleged operator, the Kimwolf botnet is running code that disguises attacks as Chrome traffic and fetches its orders from the Ethereum blockchain. The post Kimwolf botnet rebuilt to survive takedowns, researchers say appeared first on CyberScoop.","The Kimwolf botnet has been rebuilt with new capabilities to evade detection and disruption by law enforcement. The latest version disguises attack traffic as legitimate Chrome browser activity and uses the Ethereum blockchain for command and control, making it harder to seize infrastructure. This rebuild comes months after authorities seized previous Kimwolf servers and arrested an alleged operator.","Kimwolf botnet rebuilt with new features to evade law enforcement takedowns.","https:\u002F\u002Fcyberscoop.com\u002Fkimwolf-botnet-palo-alto-unit-42-android-tv-boxes\u002F","https:\u002F\u002Fcyberscoop.com\u002Fwp-content\u002Fuploads\u002Fsites\u002F3\u002F2019\u002F03\u002FGettyImages-1135692977.jpg","2026-08-12T00:13:08+00:00","2026-08-12T02:00:26.032023+00:00",8,[17,20,22,25],{"name":18,"type":19},"Ethereum blockchain","technology",{"name":21,"type":19},"HTTP\u002F2",{"name":23,"type":24},"Chrome","product",{"name":26,"type":19},"Tor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":27,"icon":29,"name":30,"slug":31},null,"Malware","malware",[33,38,40,45],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":46},{"id":47,"icon":29,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,54],{"type":31,"value":52,"context":53},"Kimwolf","Botnet name",{"type":31,"value":55,"context":56},"Aisuru","Alternative name for Kimwolf botnet",[23],{"controls":59,"vendors":147},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":90,"name":91,"problem":92,"products":93},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"slug":119,"name":120,"problem":121,"products":122},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-swg","Netskope Secure Web Gateway","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fnext-gen-swg","Cloud secure web gateway with inspection of web and cloud app traffic.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-gateway","Cloudflare Gateway","https:\u002F\u002Fwww.cloudflare.com\u002Fproducts\u002Fgateway\u002F","DNS filtering and secure web gateway.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"quad9","Quad9","\u002Fvendor-logos\u002Fquad9.png","quad9-dns","Quad9 DNS","https:\u002F\u002Fwww.quad9.net\u002F","Free, privacy-focused DNS resolver that blocks malicious domains using threat intelligence feeds.",[148],{"slug":149,"name":150,"logo_path":151,"roles":152},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[153],"reported_by",{"slug":155,"title":156,"body":157,"framework_refs":158,"framework_notes":170},"kimwolf-botnet-resurfaces-with-blockchain-c2-and-browser-camouflage","Kimwolf Botnet Resurfaces with Blockchain C2 and Browser Camouflage","The Kimwolf botnet demonstrates a critical lesson in botnet resilience: infrastructure takedowns alone are insufficient if threat actors can rapidly rebuild using decentralized and evasion-capable architectures. By leveraging the Ethereum blockchain for command-and-control, operators eliminate single points of failure that law enforcement typically targets during seizures. Disguising malicious traffic as legitimate Chrome browser activity further undermines signature-based detection tools. This evolution highlights that defenders must go beyond reactive takedowns and invest in behavioral detection, decentralized threat intelligence sharing, and network-level controls that can identify anomalous patterns regardless of traffic disguise.",[159,160,161,162,163,164,165,166,167,168,169],"CIS Control 13 - Network Monitoring and Defense","CIS Control 9 - Email and Web Browser Protections","CIS Control 12 - Network Infrastructure Management","NIST SP 800-83 - Guide to Malware Incident Prevention and Handling","NIST IR-4 - Incident Handling","NIST SI-3 - Malicious Code Protection","NIST SC-7 - Boundary Protection","MITRE ATT&CK T1071.001 - Application Layer Protocol: Web Protocols","MITRE ATT&CK T1102 - Web Service (Blockchain C2)","NIST CA-7 - Continuous Monitoring","ITIL - Problem Management (post-incident root cause elimination)",{}]