Kimwolf Botnet Swamps Anonymity Network I2P – Krebs on Security

Okay, here’s a revised version of the text, incorporating⁤ verification adn corrections based on web searches as of today,​ November⁢ 2, 2023. I’ve highlighted the⁢ changes⁣ made with explanations.


The I2P anonymity network is currently‌ experiencing a surge in activity,likely linked to the operators ​of the Kimwolf botnet attempting to establish a resilient command and control infrastructure.

George (last name‌ not publicly available), known as “Unit 221B” and the‌ original founder of I2P, told ‍KrebsOnSecurity‍ the entire I2P network⁢ now consists of between 15,000 and 20,000 ⁢devices on any given‌ day.

An I2P user posted this graph on Feb. 10, 2023, showing tens of thousands of ‌routers — mostly from the united States — ⁢suddenly attempting to join the network.

Benjamin Brundage is⁤ founder of Synthient,a startup that tracks proxy services and was the first to document Kimwolf’s unique ⁣spreading ⁤techniques. Brundage said the Kimwolf operator(s) ‌have been trying to build a command and control network that can’t easily be⁣ taken down by security companies and ⁣network operators​ that are working⁤ together to combat‌ the spread of the botnet.

Brundage ⁣said the⁤ people in control of Kimwolf⁢ have been experimenting with using ‍I2P and a similar‌ anonymity network — Tor — as a ⁢backup command and control ‌network, even though there have been no reports of widespread disruptions in the Tor network recently.

“I ‍don’t think their goal is to ⁣take I2P ⁤down,” he said. “It’s more they’re ⁢looking for an alternative to‍ keep the botnet​ stable in the face of ‌takedown‌ attempts.”

the Kimwolf botnet‍ created challenges for ​Cloudflare late last year when it began instructing millions of infected devices to use Cloudflare’s‍ domain name ⁢system (DNS) settings, causing ⁤control domains associated‌ with​ Kimwolf to repeatedly usurp Amazon, Apple, Google and Microsoft in Cloudflare’s public ranking of ‍the⁣ most frequently requested websites.

James (last name not publicly⁣ available) said the I2P network is still operating at about half of its normal capacity, and that a‌ new release is rolling out which should bring some ⁢stability

Leave a Comment