Get the latest crypto news, updates, and reports by subscribing to our free newsletter.
Giấy phép số 4978/GP-TTĐT do Sở Thông tin và Truyền thông Hà Nội cấp ngày 14 tháng 10 năm 2019 / Giấy phép SĐ, BS GP ICP số 2107/GP-TTĐT do Sở TTTT Hà Nội cấp ngày 13/7/2022.
© 2026 Index.vn
Autumn 2025 marked a turning point in global cybersecurity as a botnet known as Kimwolf quietly expanded from data centers to everyday consumer devices. The period saw a wave of distributed denial-of-service (DDoS) attacks, culminating in a major assault on a cloud service provider at year’s end. Researchers said the traffic volume was roughly equivalent to the combined populations of the UK, Germany, and Spain hitting a single site.
Security researchers traced the operation to Kimwolf, which blended residential proxy networks with malicious software. The botnet enabled attackers to recruit millions of ordinary devices—including Android phones, smart cameras, and inexpensive digital photo frames—into a data-fluxing army that device owners did not realize they had been enrolled into.
Investigators traced Kimwolf’s control to a backdoor in a proxy service provider referred to in documents as Company A. Brundage and Big Pipes mapped the threat and determined that Kimwolf rented access to compromised devices and injected a control layer that turned about two million devices into a malicious army. Each day, the botnet absorbed tens of thousands of new victims, ranging from smart TVs to low-cost digital frames.
The investigation also identified a supply-chain vulnerability. By factory, more than ten million Android devices were reported to have been pre-installed with malicious software.
The “unsung hero” behind the takedown was Benjamin Brundage, a 22-year-old student at the Rochester Institute of Technology. Brundage built a data blacklist company called Synthient in August 2025 and began a Discord-based data-search tool. In September, an anonymous account messaged him with gaps in his IP list and provided a string of images as proof. Instead of arguing, Brundage responded with a six-second animated cat meme, which reportedly lowered the hacker’s guard and helped open access to clues about a major vulnerability.
In November, Brundage loaded Company A’s software onto an Android phone to test the theory and confirmed it was a highly sophisticated backdoor. The joint investigation concluded that the malware spread through the supply-chain issue, with more than ten million Android devices already pre-installed with malicious software. In December, Brundage alerted eleven involved parties and urged rapid patching.
The dismantling of Kimwolf and related operations was described as a decisive step in protecting critical internet infrastructure from crippling attacks. Netscout data indicated the botnet’s footprint shrank from nearly two million compromised devices globally to roughly thirty thousand devices still operating across the internet.
The account emphasized that the downfall of a cybercriminal operation can start with unexpected, low-friction signals—such as a simple image—combined with follow-through by investigators, rather than relying only on high-powered defenses or large-scale intelligence operations.
Premium gym chains are entering a “golden era” that is ending or already in decline, as rising operating costs collide with shifting consumer preferences toward more flexible, community-based ways to exercise. Long-term memberships are shrinking, margins are pressured by higher rents and facility expenses, and competition from smaller, more personalized…