Wednesday 14 October 14:00 - 14:30, Red room
Asher Davila, Chris Navarrete & Doel Santos (Palo Alto Networks)
Smart TVs and set-top boxes have become a silent battleground. Over the past months we have been tracking what can only be described as a war between at least three different botnet operations, all competing to infect the same pool of Android TV and STB devices through a single shared vector: exposed ADB debugging ports. This talk presents original research into three interconnected pieces of this ongoing conflict.
We start by dissecting the Tuxbot framework, a previously undocumented botnet framework that serves as the initial access and propagation component for the AISURU/Kimwolf botnet ecosystem. It is a self-propagating worm targeting 12 device families through known vulnerabilities and brute-forcing telnet with over 80 credential pairs. We obtained a build of it, giving us unusual visibility into how the whole operation is structured.
Then we get into Kimwolf version 7, a major update to the botnet that has been linked to record-breaking DDoS attacks reaching 30 Tbps. This version introduces HTTP/2 floods that construct full Chrome browser fingerprints so the attack traffic blends in with real users, a Tor hidden service for backup C2, and five Ethereum RPC endpoints for decentralized C2 resolution through ENS. These upgrades came as a direct answer to the takedown efforts documented in late 2025 and early 2026, showing that whoever is behind this is paying close attention.
Finally, we introduce Lorikazz, a previously unreported Android botnet we discovered and named based on our telemetry. Lorikazz goes after the exact same devices but with a different end goal: instead of DDoS it turns infected set-top boxes into residential proxies for monetization. It uses Tor-based C2 and ENS resolution, and ships in multiple APK variants that disguise themselves as Android system components. There is notable code overlap between Lorikazz and Kimwolf, which raises some interesting questions about whether this is the same operator branching into new revenue streams or a separate group that got hold of the codebase.
What really ties all of this together is that these botnets are actively at war with each other. Their dropper scripts contain explicit uninstall routines that target each other's packages. Jackskid removes Lorikazz, Lorikazz removes Jackskid and the Snow botnet, and so on. They clearly know about each other and are all fighting over the same device population. Several of the samples we analysed came exclusively from our own telemetry and were not on VirusTotal at the time, which means we had a front row seat to a conflict that largely goes unnoticed by the broader security community.
We will walk through the technical details of each operation, demonstrate how the competition between them plays out on actual devices, and trace the evolution from basic ADB scanning to sophisticated infrastructure using blockchain-based C2 and onion routing. Attendees will walk away with concrete indicators and detection strategies for spotting these infections in environments where Android TV and STB devices are present.
 |
Asher Davila Asher Davila is a principal security researcher at Palo Alto Networks. Originally from Mexico and now based in Silicon Valley, he specializes in binary analysis, exploitation, reverse engineering, and hardware hacking with a focus on IoT and OT vulnerabilities and malware research. When he is not tearing apart botnet infrastructure or hunting for new threats, you can probably find him messing around with retro hardware, emulators, or building exploits for fun. He has presented his research at multiple security conferences and actively contributes to the global cybersecurity community.
|
 |
Chris Navarrete Chris Navarrete is currently a senior principal security researcher at Palo Alto Networks. He previously worked as an adjunct professor of computer science at San Jose State University. Chris holds an M.S. degree in software engineering with a specialization in cybersecurity from San Jose State University. He has presented at the Threat Intelligence Practitioners' Summit (TIPS), DEF CON (IoT Village), Black Hat Asia (Briefings), and Black Hat USA (Arsenal), where he released the BLACKPHENIX Malware Analysis and Automation Framework.
|
 |
Doel Santos Doel Santos is a principal threat researcher with Palo Alto Networks' Unit 42, originally from Puerto Rico. He focuses on both cybercrime and nation-state threats, with a particular emphasis on ransomware operations. His work involves hunting, detecting, and tracking threat actors across the global threat landscape, and he has authored investigations on groups such as Prometheus, Medusa, Cl0p, Avos, LockBit, and Stately Taurus. Doel has also contributed to the security community beyond research, previously serving as a organizer for BSidesCharm and participating as a threat hunter in the Black Hat Network Operations Center (NOC). |
Back to VB2026 conference page
Register your interest for VB2026