Plan
active
Kimwolf v7 Android/IoT Botnet Camouflages HTTP/2 DDoS as Legit Traffic
- Engineer — Learn: The HTTP/2 traffic-mimicry technique is worth understanding when reviewing WAF and CDN rate-limiting rules, but no enrichment signals (no KEV, no PoC, no active targeting) justify an immediate configuration change.
- SOC/IR — Plan: The botnet’s ability to blend DDoS volume into legitimate-looking HTTP/2 sessions is a detection gap worth scoping — review whether your traffic-analysis and DDoS-detection rules distinguish request-rate anomalies at the HTTP/2 stream level rather than relying on IP reputation alone.
- Leader — Learn: Awareness item for the evolving DDoS evasion landscape; relevant background for the next DDoS-mitigation vendor review or business-continuity risk discussion, but no board-level action is warranted now.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.