Kimwolf v7 Android Botnet Makes HTTP/2 DDoS Traffic Look Like Legitimate Browsing

Palo Alto Networks Unit 42 discovered Kimwolf v7, an Android and IoT botnet improvement that adds HTTP/2-based DDoS traffic mimicking legitimate browsing behavior. The new version enhances operational resilience for distributed denial-of-service attacks, discovered in February 2026. The HTTP/2 capability makes malicious traffic harder to distinguish from normal web activity, posing a significant detection challenge for defenders.