Plan
active
Kimwolf v7 Botnet Uses Ethereum ENS for C2 and Tor Backup Routing
- Engineer — Learn: Kimwolf v7’s use of Ethereum Name Service for C2 resolution and Tor as a fallback is a novel evasion pattern worth incorporating into threat models for IoT/edge assets, but no patch or config change applies to typical cloud/AppSec environments.
- SOC/IR — Plan: The ENS-based C2 resolution and Tor backup routing introduce detection gaps in traditional domain-block and DNS monitoring approaches; plan detection coverage for anomalous Ethereum ENS lookups and unexpected Tor traffic from IoT segments this quarter.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.