Kimwolf v7 Uses Ethereum ENS and HTTP/2 to Upgrade DDoS Attacks

Kimwolf is a botnet that marshals compromised devices to overwhelm targets with distributed denial-of-service, or DDoS, traffic. Its seventh iteration adds HTTP/2 capabilities designed to make malicious requests resemble connections from ordinary web browsers. That matters because closer imitation of legitimate browser behavior can complicate traffic filtering, raising the cost and difficulty of defending websites and online services against high-volume attacks.

A cybersecurity vendor said Kimwolf v7 can emulate browser fingerprints over HTTP/2 to conceal DDoS traffic. The malware also embeds Ethereum RPC nodes and queries the Ethereum Name Service, or ENS, to locate command-and-control servers. The blockchain-based setup gives operators a more seizure-resistant communications channel by reducing reliance on a single conventional domain or host. The available report did not identify the vendor or disclose a publication date, attack volume, financial losses or confirmed victims.