Botnet operators are hiding command servers behind Ethereum names

A command server is only useful if the infected devices can find it. For years that lookup was a domain name. A registrar, or a court, can seize the domain, and the botnet goes quiet until the operator registers another one. Some operators have moved the lookup onto Ethereum, where the name is controlled by a key they hold, and anyone can read the record but almost nobody can change it.

What the Ethereum Name Service is

The Ethereum Name Service (ENS) is a naming system on the Ethereum blockchain. A name such as example.eth is not a website and not a DNS name. Normal DNS is a phone book run by registries and registrars: companies that can suspend a name when a court tells them to. An ENS name is a record on Ethereum, owned by an address. Whoever holds the private key for that address can change what the name points at. A registrar cannot.

The name has parts, and the malware uses two of them.

A resolver is a smart contract, a small program stored on Ethereum, that answers questions about the name. One of those questions is a text record: a labeled string the owner can set to anything. People use text records for profile links and public keys. A botnet can put a command-and-control address there instead. Researchers call that EtherHiding when the command data lives in blockchain state rather than in DNS. Nokia Deepfield’s emergency response team uses the word for Kimwolf. The address is encoded, so opening the record does not show a plain IP.

To read it, software sends a JSON-RPC request. That is the ordinary way a wallet or a block explorer talks to an Ethereum node: a small request over HTTPS, and a small answer. The malware calls two functions. resolver() returns the contract that holds the name’s records. text() returns the string. No password is required to read. Writing still takes the owner’s key.

That is the trade. The name is hard to seize, and it is not a secret. Anyone can look up the same record the bots are looking up. Defenders can watch it. They just cannot point it somewhere else.

How Kimwolf asks

Unit 42’s write-up of Kimwolf version 7 found five public Ethereum endpoints compiled into the program in plain text. They are normal public services, the kind a wallet uses when it doesn’t run its own node:

• 0xrpc.io
• eth.llamarpc.com
• ethereum-rpc.publicnode.com
• eth-protect.rpc.blxrbdn.com
• eth.merkle.io

Before each lookup the malware shuffles the list and tries one. Five well-known services means there is no single provider to cut off, and blocking them would also block people using those services for real. Unit 42’s advice is to watch for this traffic from a TV box or a phone, not to ban the endpoints.

Deepfield, mapping the wider set of botnets on March 20, 2026, found one extra step in front of that. The first lookup, the one that finds the Ethereum endpoint itself, goes over DNS-over-TLS. The device asks a DNS resolver over an encrypted connection, so the name of the Ethereum service doesn’t show up as an ordinary DNS query on the network. Only after that does the JSON-RPC call happen.

Two of the .eth names the operator rotated through are pawsatyou.eth and re6ce.eth. Deepfield lists a third. It is a racial slur, so it isn’t repeated here. The original report prints it because defenders need the indicator.

Unit 42 also describes a sixth endpoint, eth.rpcuniverse.com, which it assesses with moderate confidence is run by the operator rather than offered as a public service. It doesn’t look like the other five. Those are busy, long-lived services spread across many addresses. This one, in Unit 42’s account, sits on a single low-cost server, and some samples contain it alongside the public five. Unit 42 could not confirm who registered it. The distinction matters for the check at the end: a TV box talking to a public Ethereum API is already odd. A TV box talking to a little-known one is a stronger signal. Neither case is a reason to block the public five.

Kimwolf, on Android TV boxes

Kimwolf is the Android side of a botnet that also runs on Linux gadgets under the name Aisuru. Unit 42 describes them as separate codebases under the same operators. Aisuru has been active since August 2024 and started on Linux devices. Around August 2025 the same operators turned to Android TV boxes and set-top boxes, and that side is Kimwolf.

The way in is Android Debug Bridge, the debugging port some of those boxes leave open with no password. It listens on port 5555. The operators reach it by tunneling through a residential proxy, so the box treats the connection as local, and then install the malware with no login prompt. Version 7 no longer carries its own scanner or exploit kit. Unit 42 reads that as a split: other loaders handle the break-in, and the bot itself handles attacks and relay.

Takedowns in December 2025 knocked the command servers offline more than once. Version 7, first seen by Unit 42 on February 3, 2026, after public research from XLab, Synthient, Infoblox and Cloudflare, was built to outlast the next one. It has three ways to find its orders:

1. ENS, as above. If the text record moves to a new server, the bots follow without a new domain and without a new build of the malware.
2. A Tor hidden service. If the ENS lookup fails, version 7 falls back to an .onion address compiled into the program. That address doesn’t appear in public DNS either. There is no registrar in that path.
3. A local proxy on the device, at 127.0.0.1 port 23075. Command traffic goes through it whether the next hop is the ordinary internet or Tor, and the proxy can be swapped without replacing the whole bot.

On a TV box the process renames itself netd_service, which is meant to look like an Android system process. Some related builds ship as an Android app that pretends to be a system service and carries the bot inside.

What the bots are for, in this version, is mostly denial-of-service traffic aimed at someone else, plus relay. Unit 42 counts fifteen flood methods in version 7, down from 43 named methods in older builds. One of the new ones is an HTTP/2 flood that builds the kind of headers a browser sends, so the attack traffic is harder to tell from someone actually loading a page. Another speaks ordinary encrypted web traffic. The box doesn’t have to look broken to be in the botnet. It can look like it is browsing.

Jackskid, four days after the seizure

On March 19, 2026, the U.S. Justice Department and partners announced a court-authorized operation against command infrastructure used by Aisuru, Kimwolf, Jackskid and Mossad. Unit 42’s later note on the same research says the seizure included command domains. Seizing a server, or a domain, is not the same as holding the key that writes an ENS record.

Deepfield’s Jackskid report describes what that operator did next. Before the disruption, Jackskid kept its command address in ordinary domains and rotated a large set of IP addresses behind them: more than 98 addresses across six domains. After March 19, many of those domains stopped resolving, and most of the old servers stopped answering. Builds dated March 23 resolve the command server through the ENS name m3rnbvs5d.eth, reading an encoded address from a text record. Same idea as Kimwolf, different encoding. Deepfield counted five live addresses behind that name. The botnet was still reachable. It was much smaller. Deepfield also saw stripped-down builds in the same week that skipped DNS entirely and carried a command address in the program itself, which is what you do when you no longer trust the phone book.

ENS did not make Jackskid whole. It gave the operator a channel the seizure didn’t cover, at a fraction of the old capacity.

Why catching one channel isn’t enough

Deepfield traces Aisuru, Jackskid, Kimwolf and MossadProxy (Mossad, in the Justice Department release) to one lineage of code and infrastructure. Across those four, it counts five ways of finding orders: DNS TXT records, DNS-over-HTTPS, ENS, an alternate DNS system called OpenNIC, and a custom encrypted protocol that leaves no DNS trail once the first lookup has worked. Not every bot uses every channel. OpenNIC names don’t resolve through the resolvers most people use, such as 1.1.1.1 or 8.8.8.8, so they don’t show up in a normal DNS log. ENS names don’t show up there either. A takedown aimed at one of those channels leaves the others.

That is the practical point of the Ethereum names. They are not hidden. They are awkward to take away.

What to check at home

You don’t have to use Ethereum for any of this, and a phone or a laptop isn’t the usual target. These botnets run on TV boxes and other always-on gadgets, and the harm they do is mostly attack traffic aimed at someone else. A few checks are still worth making:

1. On an Android TV box, leave developer options off. Kimwolf’s way in is an open Android Debug Bridge. If a menu offers USB debugging or network debugging, turn it off. If you actually need debugging, USB-only is the setting Unit 42 points at. A box you can’t update, from a brand you can’t look up, is the kind these campaigns scan for.
2. Keep the box off the rest of the network if you can. A guest network, or an unplugged ethernet cable, limits what a compromised box can see. Unit 42’s plain version of this is to treat an Android TV box as untrusted.
3. Ethereum traffic from a TV box or a phone is the signal. Those devices don’t need to talk to an Ethereum node, and they don’t need Tor. Unit 42 names the signs: outbound connections to public Ethereum services, Tor from a TV box, a process called netd_service, or something listening on port 23075 of the box itself. Most people can’t inspect a process list on a television. The traffic, and a box that won’t stay quiet, is enough.
4. Don’t “fix” it by blocking public Ethereum services. Those five endpoints are shared infrastructure. Blocking them doesn’t remove the bot, and it does break real wallets and explorers on machines that actually use Ethereum. The odd part is which device is asking.
5. Unplug a box that won’t stay quiet. Heavy traffic while the screen is off, or a box that keeps reaching out after you think it’s off, is reason enough to disconnect it.

Nothing here is fixed by a cleanup tool someone texts you.

Sources

• Kimwolf v7: An Evolution of the Kimwolf Botnet, Palo Alto Networks Unit 42. The article notes an August 13, 2026 update on the Justice Department seizure.
• Shared code, shared secrets: tracing four DDoS botnets to one ecosystem, Nokia Deepfield ERT, March 20, 2026.
• Jackskid, Nokia Deepfield ERT.
• Authorities disrupt IoT DDoS botnets, U.S. Department of Justice, March 19, 2026.