Kimwolf v7 Botnet Uses Ethereum ENS for C2 and Tor Backup Routing

Tue, 11 Aug 2026 11:54:43 +0000

Engineer — Learn: Kimwolf v7’s use of Ethereum Name Service for C2 resolution and Tor as a fallback is a novel evasion pattern worth incorporating into threat models for IoT/edge assets, but no patch or config change applies to typical cloud/AppSec environments.
SOC/IR — Plan: The ENS-based C2 resolution and Tor backup routing introduce detection gaps in traditional domain-block and DNS monitoring approaches; plan detection coverage for anomalous Ethereum ENS lookups and unexpected Tor traffic from IoT segments this quarter.
Leader — Skip

Android-Iot on CuraSec