Botnet Blackout: The Underworld Proxy Empire Unplugged

It began with a surge-a sudden, 300% spike in hijacked Android devices joining a mysterious proxy network. By mid-October 2025, security researchers at Black Lotus Labs had traced the digital breadcrumbs to a sprawling botnet empire, orchestrated through Kimwolf and its sibling malware, Aisuru. Their mission: to sever the command lines of one of the largest cybercriminal proxy operations in recent memory. What they uncovered was a cunning scheme that transformed millions of everyday devices into unwitting foot soldiers for cybercrime.

Fast Facts

• Over 550 botnet command-and-control (C2) servers null-routed by researchers since October 2025.
• Kimwolf and Aisuru botnets infected more than 2 million Android devices, primarily TV streaming boxes.
• Compromised devices were conscripted as residential proxies, masking criminal activity as legitimate traffic.
• Traffic from these botnets was sold on underground markets, with operators using Discord servers to peddle access.
• Researchers identified a network of 832 hacked routers in Russia, all functioning as proxy nodes for cybercriminals.

The Anatomy of a Proxy Botnet

Kimwolf and Aisuru are not your average botnets. Unlike classic DDoS armies, these malware strains specialize in hijacking consumer-grade devices-namely Android TV boxes and small office/home office (SOHO) routers. By exploiting exposed Android Debug Bridge (ADB) services and leveraging vulnerable proxy SDKs like ByteConnect, attackers transformed these gadgets into gateways for illicit internet activity. The infected devices, now operating as residential proxy nodes, allowed criminals to rent out their IP addresses, making malicious traffic appear as innocuous as a Netflix binge.

The operation was slick. Botnet operators scanned for vulnerable devices, dropped their malware, and funneled traffic through residential networks. The public IPs of these infected devices were then listed for rent on shadowy proxy marketplaces, many of which were openly coordinated via Discord servers like resi[.]to. Even the hosting provider Resi Rack LLC, advertised as a legitimate game server company, was implicated, with its co-founders allegedly selling access to the proxy network for years.

As the botnet grew-adding up to 800,000 new bots in just one week-researchers observed Kimwolf scanning competing proxy services to find even more targets. Meanwhile, other groups were busy compromising routers across Russian ISPs, automating mass exploitation to quietly add hundreds of SOHO routers to the proxy pool. These endpoints, with their “clean” residential reputations, slipped under the radar of most security tools.

The Real-World Fallout

This proxy empire enabled a spectrum of cybercrime: from DDoS attacks and credential stuffing to malware distribution and fraud. The brilliance of the scheme lay in its invisibility; by blending in with ordinary home internet traffic, malicious actors evaded detection and blacklisting. For end users, it meant their devices were weaponized without their knowledge, their bandwidth and trust quietly sold to the highest bidder.

The takedown orchestrated by Black Lotus Labs-null-routing over 550 C2 servers-has dealt a serious blow to these operations. But as long as consumer devices remain unpatched and proxy networks lucrative, the arms race between attackers and defenders is far from over.

Looking Ahead

The Kimwolf and Aisuru saga is a stark warning: our smart homes and connected devices are now prime real estate for cybercriminals. Vigilance, regular updates, and skepticism toward unknown apps are the new essentials. Because in the proxy underworld, your TV box might just be the next unwitting accomplice.

WIKICROOK

• Botnet: A botnet is a network of infected devices remotely controlled by cybercriminals, often used to launch large-scale attacks or steal sensitive data.
• Command: A command is an instruction sent to a device or software, often by a C2 server, directing it to perform specific actions, sometimes for malicious purposes.
• Residential Proxy: A residential proxy uses a real home IP address to make online activity appear as if it comes from a genuine user, masking the true source.
• Null: Null means an empty or undefined value in data or software, which can cause security issues if not properly managed.
• Android Debug Bridge (ADB): ADB is a command-line tool for managing Android devices, useful for developers but potentially risky if misused or left unsecured.