Kimwolf Botnet Infects Over 2 Million IoT Devices in Corporate and Government Networks

The Kimwolf botnet has rapidly spread to over 2 million IoT devices, primarily targeting residential proxy services such as IPIDEA. This malware forces compromised systems to participate in DDoS attacks and relay harmful Internet traffic. Kimwolf’s ability to scan local networks for additional vulnerable devices makes it a significant threat to organizations, particularly in government and corporate sectors.

Since its emergence in late 2025, Kimwolf has exploited various residential proxy services to relay malicious commands to devices on local networks. The malware is often bundled with mobile apps and games, which can turn devices into proxy nodes without the user’s knowledge. This has led to a concerning prevalence of Kimwolf in corporate networks, with Infoblox reporting that nearly 25% of its customers queried a Kimwolf-related domain since October 1, 2025.

Research from Synthient indicates that Kimwolf has affected at least 33,000 Internet addresses at universities and colleges, along with nearly 8,000 IPIDEA proxies within U.S. and foreign government networks. The implications are severe, as these infections can lead to unauthorized access and lateral movement within networks.

Experts have noted that the presence of Kimwolf in networks, including those belonging to the U.S. Department of Defense, raises alarms about the security of devices behind firewalls. The malware’s association with unsecured Android TV streaming boxes, often marketed for pirated content, further complicates the issue as these devices typically lack proper security measures.

Organizations must be vigilant about the risks posed by residential proxy infections, as they can provide attackers with footholds to probe other devices on local networks. The situation highlights the need for improved security protocols and monitoring of devices that connect to corporate networks.

Understanding the Threat Landscape

Kimwolf exemplifies how a single compromised device can lead to broader security challenges for organizations. The botnet’s ability to exploit residential proxies and scan for additional vulnerabilities underscores the importance of securing all endpoints within a network.

As the threat landscape evolves, organizations should prioritize identifying and mitigating risks associated with unsecured devices, particularly those that may be unknowingly connected to residential proxy services.