Listen to this Post
Introduction: When Takedowns Stop Being the End
Cybersecurity has entered an uncomfortable new phase. Taking down a criminal server, blocking a domain, or seizing an infrastructure cluster can still hurt attackers, but increasingly it does not guarantee that the operation will stay down. The latest developments surrounding the Kimwolf botnet and DeadLock ransomware show why.
Kimwolf has rebuilt its infrastructure around technologies designed to survive disruption. Its newest version uses HTTP/2 attacks that imitate Chrome browser traffic, while its command-and-control architecture can turn to Ethereum Name Service, Tor, and local proxy mechanisms when conventional infrastructure becomes unavailable. Palo Alto Networks Unit 42 describes this as a deliberate evolution following previous disruption operations.
At almost the same time, DeadLock has demonstrated another side of the same trend. Rather than relying entirely on conventional centralized infrastructure, the ransomware operation has incorporated Polygon smart contracts and Session-style encrypted communications into its extortion ecosystem. Earlier research documented the use of Polygon to rotate proxy infrastructure and HTML-based communication clients connected to Session-style messaging.
The common theme is not simply malware sophistication. It is operational resilience.
Attackers are increasingly designing systems that assume someone will eventually discover them, block them, seize their servers, or dismantle their infrastructure. Instead of trying to remain invisible forever, they are building architectures capable of surviving the moment they are exposed.
The Bigger Picture: Cybercrime Is Learning From Disruption
The original reports highlighted two important developments. Kimwolf has evolved its DDoS capabilities and command infrastructure, while DeadLock has developed a decentralized communications and extortion ecosystem.
Those developments are significant individually, but together they reveal a larger strategic shift.
Traditional cybercrime infrastructure often depended on domains, virtual private servers, centralized panels, conventional messaging services, and fixed command-and-control addresses. Destroy enough of those components and an operation could be seriously damaged.
That model is becoming less attractive to sophisticated criminal operators.
Blockchain naming systems, onion routing, encrypted peer-oriented communications, rotating proxies, and browser-like traffic provide attackers with multiple layers of redundancy. None of these technologies makes an operation impossible to dismantle, but they can increase the cost, time, and complexity of disruption.
The result is a cybersecurity environment where defenders increasingly have to attack behavior and architecture, rather than simply attacking an IP address or domain.
Kimwolf v7: A Botnet Built to Survive
Kimwolf is not a completely new threat. The Android-focused botnet has already been associated with the broader Aisuru ecosystem and has been linked to millions of compromised devices.
Broadcom previously reported that Kimwolf had infected more than two million Android devices and possessed capabilities including DDoS attacks, proxy forwarding, reverse shells, and file management.
The U.S. Department of Justice also announced an international operation in March 2026 targeting infrastructure associated with Aisuru and KimWolf, describing the networks as major DDoS botnets.
That history makes the latest evolution particularly important.
The operators are not simply rebuilding the same botnet after disruption. They are changing the architecture around it.
HTTP/2 Becomes a Weapon
One of the most important Kimwolf changes is the use of HTTP/2 for DDoS flooding.
HTTP/2 is not inherently malicious. It is a standard web protocol used by legitimate websites, applications, browsers, APIs, and cloud services around the world.
The problem is that Kimwolf uses the protocol in a way designed to make malicious traffic resemble legitimate browser activity.
Unit 42 identified an HTTP/2 flood implementation that constructs browser fingerprints and imitates characteristics associated with Chrome traffic.
That creates a difficult defensive problem.
A traditional DDoS defense can often identify obviously abnormal traffic patterns. But if malicious requests begin to resemble the structure and behavior of genuine browser sessions, simplistic filtering becomes less effective.
The defender faces a dangerous question: How much traffic can be blocked before legitimate users begin getting blocked too?
Why Chrome-Like Fingerprints Matter
Browser fingerprinting normally belongs to the world of tracking, fraud detection, authentication, and security analytics.
Kimwolf turns the concept around.
Instead of allowing defenders to fingerprint the attacker, the bot attempts to present a convincing identity of its own.
The attack traffic can contain characteristics designed to resemble a normal Chrome client, potentially making automated classification more difficult.
This does not make Kimwolf invisible.
It means the detection problem moves upward.
Defenders increasingly need to evaluate behavior across connections, request timing, TLS characteristics, HTTP/2 patterns, source reputation, geographic anomalies, endpoint behavior, and application-layer context rather than relying on a single signature.
The Ethereum Name Service Becomes Part of the C2 Chain
The second major Kimwolf development is even more unusual.
Researchers found that the botnet can use Ethereum Name Service, or ENS, as part of its command-resolution architecture. The system effectively separates the malware from a traditional fixed command server.
Instead of embedding a single permanent address that can simply be blocked, the malware can retrieve infrastructure information through a decentralized naming layer.
Unit 42 describes a three-tier resolution strategy involving Ethereum ENS, Tor, and a local proxy mechanism.
This is a major architectural change.
Why Decentralized Naming Changes the Game
A conventional domain can be seized, suspended, redirected, or blocked.
A blockchain-based naming mechanism creates a different problem.
The record is not simply sitting on one ordinary DNS server controlled by one company. It is associated with a decentralized blockchain ecosystem.
That does not mean ENS is immune to investigation or disruption. It means defenders cannot automatically apply the same playbook they would use against a conventional criminal domain.
The attacker is essentially moving one piece of the command infrastructure into an environment designed to resist centralized control.
Tor Adds Another Layer
Kimwolf also uses Tor as a fallback component.
Tor can conceal the location of services and make infrastructure mapping more difficult. When combined with decentralized naming, it creates another layer between infected devices and the infrastructure ultimately controlled by operators.
Unit 42 observed Tor-based backup routing as part of the newer architecture.
The important point is not that Tor is inherently criminal. Tor is a legitimate privacy technology used by journalists, researchers, activists, and ordinary users.
The concern is its incorporation into a malicious command-and-control fallback architecture.
The Architecture Is More Important Than Any Individual Technique
The most interesting part of Kimwolf v7 is not HTTP/2 alone.
It is not ENS alone.
It is not Tor alone.
It is the combination.
An attacker now has multiple routes:
Browser-like HTTP/2 traffic → conventional network paths → ENS resolution → Tor fallback → local proxy mechanisms.
If one layer is disrupted, another can potentially take over.
This is the architectural equivalent of redundancy in critical infrastructure.
Kimwolf Is Also a Lesson About IoT Security
The
Cheap streaming boxes, smart televisions, cameras, routers, DVRs, and other connected devices are often deployed with weak security assumptions.
Some remain unpatched for long periods.
Some expose unnecessary services.
Some use weak or default credentials.
Some are difficult to monitor because organizations and consumers do not even realize they are operating full network-connected computing environments.
Cloudflare describes Kimwolf as an Android-focused component of the broader Aisuru ecosystem and notes the enormous scale of the combined botnet environment.
The March Takedown Did Not End the Story
The international disruption operation against Aisuru and Kimwolf was an important law-enforcement success.
The U.S. Department of Justice said authorities seized command-and-control infrastructure associated with the botnets in March 2026.
But cybersecurity history repeatedly demonstrates an uncomfortable reality.
Infrastructure can be seized.
Operators can be arrested.
Domains can disappear.
Yet malware development can continue.
The appearance of a redesigned Kimwolf architecture demonstrates why defenders must distinguish between infrastructure disruption and threat elimination.
The former can be highly effective without necessarily producing the latter.
DeadLock Takes a Different Route
Kimwolf is primarily concerned with maintaining control over compromised devices and launching attacks.
DeadLock represents a different criminal objective: extortion.
Yet its infrastructure strategy follows a surprisingly similar philosophy.
DeadLock has incorporated decentralized technologies into communications and operational infrastructure, including Polygon smart contracts and Session-style encrypted communications.
This is important because ransomware traditionally relies on centralized infrastructure for negotiation, victim portals, payment instructions, and leak sites.
DeadLock is challenging that assumption.
Polygon Becomes Part of the Extortion Infrastructure
Researchers previously documented DeadLock using Polygon smart contracts to manage and rotate proxy addresses.
That is more than a cryptocurrency payment mechanism.
The blockchain becomes an infrastructure coordination layer.
The advantage for an attacker is obvious. A smart contract can provide a mechanism for publishing or retrieving information without requiring the attacker to maintain a conventional centralized server for every function.
This can complicate takedown operations.
Session Changes Victim Communication
DeadLock has also used an HTML-based communication interface associated with Session-style encrypted messaging.
ThreatScene’s technical analysis described an HTML file placed on a victim’s desktop that implemented a browser-based chat interface and used Polygon-backed information to establish communication infrastructure.
This is a fascinating evolution of the ransom note.
The ransom note is no longer necessarily just a static document saying, “Pay us.”
It can become an application.
It can contain communication functionality.
It can act as an interface between the victim and the criminal organization.
That gives the attacker greater control over the negotiation process while reducing reliance on a conventional centralized web portal.
DeadLock’s Growth Makes the Infrastructure More Concerning
ZeroFox observed a DeadLock leak site listing roughly 80 victims in June 2026.
Other ransomware tracking data also recorded DeadLock among the most active emerging groups during June, with more than 80 publicly listed victims depending on the tracking methodology.
This is significant because
It is appearing alongside a growing operational footprint.
The more successful the group becomes, the more attractive its techniques may become to other ransomware operators.
Double Extortion Remains the Core Weapon
Despite all the technological innovation, the basic ransomware strategy has not changed.
Steal data.
Encrypt systems.
Disrupt operations.
Demand payment.
Threaten publication.
The decentralized architecture is there to protect the criminal operation surrounding that strategy.
This distinction matters.
The technology may look futuristic, but the underlying criminal business model remains brutally familiar.
Why Decentralization Is Attractive to Criminals
Centralized infrastructure creates a single point of failure.
One server can be seized.
One domain can be suspended.
One hosting provider can terminate an account.
One administrator can be identified.
Decentralized infrastructure attempts to distribute those dependencies.
The attacker does not necessarily need to make the entire operation decentralized. Even moving a single critical component into a decentralized system can force defenders to change their tactics.
This is why the development deserves attention.
The New Battlefield Is Behavioral
Security teams have traditionally depended heavily on indicators such as:
IP addresses.
Domains.
File hashes.
URLs.
Malware signatures.
These remain useful.
But resilient criminal infrastructure reduces their lifespan.
A hash can change.
An IP can rotate.
A domain can disappear.
A proxy can move.
A blockchain record can point somewhere else.
The behavior is harder to change without breaking the operation itself.
That is why modern defense increasingly requires behavioral telemetry.
What Undercode Say:
Resilience Is Becoming a Malware Feature
Kimwolf demonstrates that resilience is no longer an afterthought.
The botnet is being engineered around the expectation that infrastructure will be attacked.
That is a major psychological shift for threat actors.
They are no longer simply hiding.
They are preparing for disruption.
Browser Impersonation Raises the Detection Bar
HTTP/2 flooding with browser-like fingerprints makes application-layer DDoS detection harder.
A malicious request can look superficially legitimate.
That means rate limiting alone may not be sufficient.
Security teams need contextual analysis.
Request patterns matter.
Connection persistence matters.
TLS behavior matters.
Header consistency matters.
User-agent behavior matters.
Geographic distribution matters.
Device identity matters.
ENS Creates a New Infrastructure Problem
Blockchain naming systems provide attackers with another layer of indirection.
Security teams should not treat blockchain-related traffic as automatically malicious.
They should instead ask whether a device that normally has no reason to communicate with Ethereum infrastructure suddenly begins doing so.
That behavioral anomaly can be valuable.
Tor Should Be Evaluated in Context
Blocking Tor everywhere may sound simple.
In reality, some organizations legitimately need privacy networks.
The better approach is context.
A corporate browser connecting to an approved privacy service is one thing.
An Android TV device that suddenly launches Tor circuits while communicating with unknown infrastructure is something entirely different.
IoT Remains the Weakest Link
Consumer devices frequently lack the visibility available on enterprise endpoints.
That creates an attractive environment for botnet operators.
Security teams should treat connected devices as computers, not appliances.
Every smart device has an attack surface.
Every exposed service creates potential risk.
Every forgotten device becomes a possible foothold.
Ransomware Infrastructure Is Evolving Too
DeadLock demonstrates that ransomware innovation is not limited to encryption algorithms.
The communication system can be redesigned.
The leak infrastructure can be redesigned.
The proxy layer can be redesigned.
The negotiation process can be redesigned.
The entire extortion ecosystem can become modular.
The Centralized Internet Is Not the Only Battlefield
Security teams historically built defensive strategies around centralized infrastructure.
DNS providers.
Cloud hosts.
CDNs.
Web servers.
Email providers.
DeadLock and Kimwolf demonstrate why defenders must now understand decentralized infrastructure as part of the threat landscape.
Takedowns Still Matter
None of this means law enforcement operations are becoming useless.
The March Kimwolf and Aisuru disruption was significant.
Removing infrastructure can reduce attack capacity.
Arrests can disrupt leadership.
Seizing domains can break existing campaigns.
But defenders must expect adaptation.
The Real Objective Should Be Cost Imposition
Perfect prevention is unrealistic.
A more practical objective is making attacks expensive.
Force attackers to rebuild.
Force them to rotate infrastructure.
Force them to change malware.
Force them to expose themselves through unusual behavior.
Force them to spend resources maintaining resilience.
That is how defensive pressure accumulates.
Security Teams Need Better Correlation
An individual indicator may mean nothing.
A Tor connection may be legitimate.
Ethereum RPC traffic may be legitimate.
Chrome-like HTTP/2 traffic is obviously legitimate in many environments.
But when several unusual behaviors appear on the same device, the picture changes dramatically.
Correlation turns weak signals into stronger evidence.
The Next Generation of DDoS Defense Will Be More Intelligent
DDoS protection cannot depend entirely on static signatures.
Systems will increasingly need to understand application behavior.
They will need to distinguish genuine browser sessions from automated browser impersonation.
They will need to evaluate traffic at multiple layers.
They will need adaptive machine-assisted detection.
The Same Principle Applies to Ransomware
Ransomware detection cannot stop at the encryption event.
By then, the attacker may already have spent weeks inside the network.
Organizations need visibility into lateral movement, credential abuse, unusual data transfers, remote administration, and abnormal outbound connections.
Backups Remain Powerful
Despite all the discussion about blockchain and decentralized infrastructure, one old security measure remains extremely important.
Reliable backups.
Offline or otherwise strongly isolated backups can reduce the leverage ransomware operators gain from encryption.
But backups must be tested.
A backup that has never been restored is an assumption, not a recovery strategy.
Identity Security Matters More Than Ever
Infrastructure resilience does not eliminate the need to compromise credentials.
Attackers still need access.
Strong authentication, phishing-resistant MFA, privileged-access controls, and careful identity monitoring can prevent many intrusion paths before the malware reaches critical systems.
IoT Security Needs to Become Routine
Organizations should inventory connected devices.
Unknown devices should not be trusted.
Default credentials should disappear.
Unused services should be disabled.
Firmware should be updated.
Network segmentation should limit what a compromised device can reach.
The Threat Is Becoming Distributed
Kimwolf distributes compromised devices.
DeadLock distributes parts of its infrastructure.
The common theme is fragmentation.
Defenders therefore need centralized visibility over increasingly decentralized threats.
Cybersecurity Has Entered an Architectural Arms Race
Attackers are designing systems around survivability.
Defenders must design systems around visibility.
That is the central lesson.
The question is no longer simply, “Can we block this?”
The better question is, “Can we recognize what it is doing when its infrastructure changes?”
Deep Analysis: Detecting the New Infrastructure
Monitor Unexpected Ethereum Traffic
On Linux systems, administrators can begin by reviewing active network connections:
ss -tunap
Unexpected connections from appliances, servers, or Android management infrastructure toward blockchain-related services deserve investigation.
Inspect DNS and Network Resolution
DNS behavior can provide useful context:
resolvectl status
For deeper analysis, review resolver logs and correlate unusual domains with endpoint activity.
Search for Tor Processes
On Linux hosts:
ps aux | grep -i tor
and:
ss -lntp | grep -i tor
These commands are simple starting points for determining whether Tor-related processes or listeners exist.
Examine Outbound Connections
Network administrators can inspect active connections with:
ss -tpn
Unexpected outbound connections from devices that normally perform only limited network functions can become valuable investigation leads.
Inspect Running Processes
A suspicious process should never be evaluated only by its filename:
ps aux --sort=-%cpu | head
Correlate process activity with network connections, parent processes, execution paths, and file timestamps.
Review Recent Executables
Linux administrators can investigate recently modified executable files:
find /tmp /var/tmp /opt -type f -perm /111 -mtime -7 2>/dev/null
This can help identify newly introduced executable content in locations commonly abused by malware.
Check Persistence
Systemd services should be reviewed:
systemctl list-unit-files --state=enabled
Suspicious services should be investigated before removal.
Examine Cron Persistence
Scheduled tasks can also be reviewed:
crontab -l
and:
ls -la /etc/cron. /var/spool/cron/
Unexpected entries deserve investigation.
Monitor HTTP/2 Behavior
Security teams should collect HTTP telemetry where possible.
Look for unusually high request rates.
Look for repeated HTTP/2 sessions.
Look for identical behavioral patterns across thousands of source addresses.
Look for browser fingerprints that appear unusually consistent.
Compare Device Identity
A genuine browser normally operates within a broader behavioral context.
A botnet may reproduce a browser fingerprint but fail to reproduce human browsing behavior.
That difference can become a detection opportunity.
Investigate Blockchain Traffic Contextually
Do not automatically block every blockchain connection.
Instead, establish baselines.
A cryptocurrency exchange workstation may legitimately communicate with blockchain infrastructure.
A television box should generally have a very different profile.
Segment IoT Devices
IoT devices should not have unrestricted access to internal systems.
Network segmentation can significantly reduce the consequences of compromise.
A compromised smart TV should not become a bridge into a corporate database environment.
Use EDR Where Possible
Enterprise endpoints should have endpoint telemetry capable of correlating processes, files, users, and network connections.
The goal is not simply detecting malware.
The goal is detecting abnormal behavior.
Watch for Ransomware Precursors
Before encryption occurs, monitor for suspicious data discovery, credential access, remote administration, privilege escalation, and large outbound transfers.
The earlier the intrusion is detected, the less leverage the attacker has.
Why These Two Threats Matter Together
Kimwolf and DeadLock operate in different criminal markets.
One weaponizes compromised devices for large-scale DDoS activity.
The other weaponizes ransomware and extortion.
Yet both point toward the same future.
Cybercriminal infrastructure is becoming deliberately difficult to remove.
That is the real story.
The attackers are not merely creating better malware.
They are creating better systems around the malware.
The End of the Single Kill Switch
For years, defenders could sometimes achieve dramatic results by finding the right server.
Take down the C2.
Block the domain.
Sinkhole the infrastructure.
The malware becomes stranded.
That model becomes less reliable when command resolution can move through decentralized systems and fallback networks.
There may no longer be one switch to turn off.
There may be several.
What This Means for Security Operations Centers
Security operations centers will need to expand their monitoring beyond traditional indicators.
Threat intelligence should include infrastructure relationships.
Network monitoring should include behavioral anomalies.
Endpoint monitoring should correlate network and process activity.
Cloud environments should be monitored for unusual outbound traffic.
IoT networks should have their own security baselines.
Most importantly, alerts need context.
A single Tor connection is weak evidence.
A Tor connection from an unmanaged Android device followed by unexpected Ethereum RPC traffic and unusual outbound HTTP/2 activity is much more interesting.
The Human Element Still Matters
Technology alone will not solve this problem.
Security analysts need to understand why a particular device is behaving differently.
Administrators need to know which systems should communicate with blockchain infrastructure.
Incident responders need to recognize when a ransomware note contains an embedded communication application.
Executives need to understand why resilience investments matter even when no attack is currently visible.
Cybersecurity is ultimately about understanding systems.
The better defenders understand normal behavior, the easier abnormal behavior becomes to identify.
✅ Kimwolf’s New Architecture Is Real
Palo Alto Networks Unit 42 documented Kimwolf v7 using HTTP/2 flooding with browser fingerprinting and a multi-layer C2 architecture involving ENS and Tor.
✅ DeadLock Has Used Decentralized Infrastructure
Independent reporting documented
❌ Decentralization Does Not Make Attackers Untouchable
ENS, Tor, Polygon, and encrypted messaging can complicate disruption, but none provides absolute immunity from investigation, endpoint detection, infrastructure mapping, financial analysis, or coordinated law-enforcement action.
Prediction
(+1) Resilient Criminal Infrastructure Will Become More Common
As takedown operations improve, financially motivated threat actors will increasingly invest in backup infrastructure, decentralized naming, encrypted communications, proxy rotation, and other mechanisms designed to keep operations alive after conventional infrastructure is disrupted.
(+1) Behavioral Detection Will Become More Important
Security products will increasingly focus on what devices actually do rather than relying exclusively on static indicators. HTTP behavior, endpoint activity, connection patterns, and infrastructure relationships will become increasingly important.
(+1) Blockchain Infrastructure Will Attract More Security Research
The use of public blockchains as coordination layers gives defenders new forensic opportunities as well as new challenges. Researchers will likely develop better methods for identifying malicious smart contracts, wallet relationships, naming records, and infrastructure changes.
(-1) Simple Domain Blocking Will Become Less Effective
Blocking known domains will remain useful, but it will increasingly function as one layer of defense rather than a complete solution.
(-1) Unmanaged IoT Devices Will Remain a Major Weakness
Cheap Android TV boxes, cameras, routers, and other connected products will continue to provide attackers with enormous pools of computing power unless manufacturers and consumers improve security practices.
Final Analysis: The Threat Is Not Just Malware Anymore
The most important lesson from Kimwolf and DeadLock is not that attackers discovered HTTP/2, Ethereum, Tor, Polygon, or encrypted messaging.
The deeper lesson is that cybercrime is becoming increasingly architectural.
Attackers are designing ecosystems that expect defenders to fight back.
Kimwolf has evolved after infrastructure disruption, adding browser-like HTTP/2 attacks and multiple command-resolution mechanisms.
DeadLock has taken a similar philosophical approach from the ransomware side, using decentralized technologies to make communications and infrastructure harder to disrupt.
This creates a new challenge for defenders.
The goal cannot simply be to find the attacker’s server.
It must be to understand the entire ecosystem.
Which devices are compromised?
Which processes are communicating?
Which destinations are being contacted?
Which protocols are being abused?
Which identities are involved?
Which behaviors changed immediately before the attack?
Those questions lead to a more durable form of defense.
The next generation of cybersecurity will not be won by whoever has the longest blacklist.
It will be won by whoever can recognize malicious behavior even after the infrastructure behind it has changed.
Kimwolf’s return and DeadLock’s decentralized infrastructure are warnings of what comes next: criminal operations designed not merely to attack, but to survive the defenders trying to stop them.
▶️ Related Video (72% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: x.com
Extra Source Hub (Possible Sources for article):
https://www.medium.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
