Back to Intelligence

Kimwolf v7 IoT Botnet, CAV3RN Espionage Framework & Malicious Crypto Extensions: OTX Pulse Analysis — Enterprise Detection Pack

SA
Security Arsenal Team
September 12, 2026
12 min read

Threat Summary

Three concurrent OTX pulses paint a picture of a maturing criminal and espionage tooling ecosystem built around one common theme: abuse of legitimate, trusted infrastructure to hide command-and-control traffic in plain sight.

  1. Kimwolf v7 (Android/IoT botnet) — A new variant of the Kimwolf botnet is targeting Android TV boxes and set-top boxes, joining the AISURU family lineage of IoT DDoS operations. Version 7 adds HTTP/2-based application-layer floods with full browser fingerprint emulation, making attack traffic nearly indistinguishable from legitimate users. Its resilience model is the standout: a three-tier C2 architecture that resolves controllers through Ethereum Name Service (ENS) lookups against five hard-coded blockchain RPC endpoints, with Tor fallback. This renders traditional domain takedown and DNS sinkholing largely ineffective.

  2. Malicious Chrome/Firefox extensions (J7Tracker, VREO, Orbit Tracker, GhostApe) — Six browser extensions, linked by shared code, C2 infrastructure, and publishing history, are stealing authenticated session tokens and wallet data from users of crypto trading platforms Axiom Trade and Padre. Two earlier extensions show the operator's playbook: repackage legitimate-looking crypto trading tools, publish, harvest. Session-token theft bypasses MFA entirely — this is an identity-layer attack, not a malware problem alone.

  3. Project CAV3RN — A modular espionage framework targeting entities in Israel has evolved its C2 to use DNS A-record responses as a channel-selection mechanism: each transaction's DNS answer tells the implant whether to talk directly over HTTPS or relay through Google Apps Script — Google's own cloud — for that exchange. Modules observed include GoogleService.dll, CommunicationUxTheme.dll, net.dll, rnp.dll, and texture.dll, with DNS tunneling as a fallback channel. This is nation-state-grade traffic shaping: defenders blocking 'suspicious domains' will see nothing but google.com and script.google.com.

Collective assessment: All three campaigns converge on living-off-trusted-infrastructure (blockchain RPC, Google Apps Script, Chrome Web Store) for C2 and delivery. Perimeter domain-reputation controls are degraded against all three; detection must shift to behavioral analytics, process/module telemetry, and identity-layer monitoring.

Threat Actor / Malware Profile

Kimwolf v7 / AISURU (IoT DDoS Botnet)

  • Distribution: Exploitation of exposed Android TV boxes and set-top boxes; historical lineage links to CVE-2016-5195 (Dirty COW) for privilege escalation on older Android/Linux kernels. Sideloaded APK droppers and credential brute-forcing of ADB interfaces are common vectors for this family.
  • Payload behavior: DDoS worker supporting HTTP/2 floods with complete browser fingerprinting (TLS/JA3, header order, HTTP/2 SETTINGS frames) to defeat bot-mitigation layers.
  • C2: Three-tier architecture. Tier 1 resolves controller addresses via Ethereum Name Service through five hard-coded RPC endpoints; Tier 2 uses resolved ENS records; Tier 3 falls back to Tor hidden services. C2 addresses are stored on-chain — immutable and unstoppable via registrar action.
  • Persistence: Android init scripts / boot receivers on rooted or insecure TV box firmware; survives reboots via system partition writes where the device permits.
  • Anti-analysis: Blockchain resolution defeats sandbox network detonation (RPC endpoints return benign data without wallet context); Tor fallback obscures operator infrastructure; fingerprint spoofing defeats traffic-classification-based sandboxes.

J7Tracker / VREO / Orbit Tracker / GhostApe (Browser Extension Malware)

  • Distribution: Chrome Web Store and Firefox Add-ons, masquerading as crypto trading companion tools; repackaging of earlier takedown survivors.
  • Payload behavior: Content scripts exfiltrate authenticated session tokens and wallet-related data from Axiom Trade and Padre sessions; reads DOM/storage of trading tabs under the guise of 'portfolio tracking.'
  • C2: HTTPS exfiltration to attacker infrastructure including j7tracker.io, cloudflare.bonto.run, and susi.bonto.run — note the cloudflare. subdomain prefix designed to blend into egress logs.
  • Persistence: Native browser extension persistence (survives reboots, reinstalls with profile sync); store re-publication after takedown.
  • Anti-analysis: Benign functionality preserved; malicious paths trigger only on targeted trading domains, defeating generic review and dynamic analysis.

Project CAV3RN (Modular Espionage Framework)

  • Distribution: Targeted delivery against Israeli entities (exact vector withheld in public reporting; consistent with spear-phish or supply-chain staging).
  • Payload behavior: Modular DLL architecture — GoogleService.dll (likely the Apps Script relay module), CommunicationUxTheme.dll (comms masquerading as a Windows theme DLL), net.dll, rnp.dll, texture.dll. Tasking is pulled per-transaction.
  • C2: DNS A-record responses act as a selector, directing each transaction to either direct HTTPS (e.g., api.studiotikva.com endpoints such as /api/v1/update/check) or a Google Apps Script relay. DNS tunneling provides a low-bandwidth fallback.
  • Persistence: DLL sideloading into legitimate signed processes is the likely mechanism given the benign-sounding module names (CommunicationUxTheme.dll mimics Windows UxTheme.dll).
  • Anti-analysis: Channel rotation per transaction defeats single-session C2 fingerprinting; use of Google infrastructure defeats egress allowlisting; deployment identifiers rotate per channel switch.

IOC Analysis

The indicator set across these pulses spans four types, each with different operationalization paths:

  • File hashes (MD5/SHA1/SHA256) — The bulk of the Kimwolf and CAV3RN indicators. SHA256 values should be pushed to EDR blocklists (Defender for Endpoint CustomFileIndicators, CrowdStrike Custom IOA hash blocks, SentinelOne blocklist). MD5/SHA1 remain useful for retrospective VirusTotal/OTX pivoting but should not be the sole blocking basis. Hashes burn fast against modular frameworks like CAV3RN — treat them as hunt seeds, not durable controls.
  • Domains/hostnames — j7tracker.io, cloudflare.bonto.run, susi.bonto.run, studiotikva.com, api.studiotikva.com, ns1/ns2.studiotikva.com. Note snapshot.xyz in the extension pulse — a legitimate crypto governance service likely abused or typosquatted; validate before blocking to avoid disrupting legitimate DeFi workflows. Push the confirmed-malicious domains to DNS sinkhole/proxy blocklists and add them to TI watchlists with 90-day expiry.
  • URLs — https://api.studiotikva.com/api/v1/update/check and https://api.studiotikva.com/ac should be blocked at the secure web gateway with full-path matching, not just domain-level, since the domain may host staged benign content.
  • CVE — CVE-2016-5195 (Dirty COW) signals the privilege-escalation path for IoT/Linux targets. Audit Android TV boxes, embedded Linux, and any legacy Android fleet for kernel patch level; unpatchable devices should be network-segmented.
  • Behavioral indicators (highest value) — ENS RPC resolution from non-wallet processes, Google Apps Script (script.google.com / script.googleusercontent.com) egress from server or non-browser processes, and DNS TXT/A-record query bursts preceding HTTPS sessions (CAV3RN channel selection). These survive hash and domain rotation.

Tooling: OTX pulses ingest natively into MISP, OpenCTI, and Microsoft Sentinel (via the OTX TAXII connector). JA3/JA3S fingerprinting (Zeek, Suricata) helps with Kimwolf HTTP/2 fingerprint spoofing. For ENS traffic, monitor for JSON-RPC eth_call payloads to RPC endpoints from endpoints that have no legitimate crypto function.

Detection Engineering

YAML
---
title: Kimwolf v7 Botnet — Ethereum Name Service C2 Resolution from Non-Browser Process
description: Detects processes making JSON-RPC eth_call / ENS resolution requests characteristic of Kimwolf v7's blockchain-based C2 tier. Legitimate ENS resolution originates from wallet software; any server or IoT-adjacent process doing this is suspect.
logsource:
  category: network_connection
  product: windows
detection:
  selection_rpc_hosts:
    DestinationHostname|contains:
      - 'eth.llamarpc.com'
      - 'cloudflare-eth.com'
      - 'rpc.ankr.com'
      - 'ethereum.publicnode.com'
      - 'mainnet.infura.io'
  filter_wallets:
    Image|endswith:
      - '\metamask.exe'
      - '\brave.exe'
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
  condition: selection_rpc_hosts and not filter_wallets
falsepositives:
  - Legitimate Web3 infrastructure nodes and crypto development workstations
level: high
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.t1568
status: experimental
author: Security Arsenal Threat Intel
---
title: Project CAV3RN — Google Apps Script Relay Used as C2 Channel
description: Detects non-browser processes establishing HTTPS connections to Google Apps Script endpoints, consistent with CAV3RN's script.google.com relay channel. Browsers are filtered; any executable making direct Apps Script calls warrants triage.
logsource:
  category: network_connection
  product: windows
detection:
  selection_gas:
    DestinationHostname|contains:
      - 'script.google.com'
      - 'script.googleusercontent.com'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\firefox.exe'
      - '\msedge.exe'
      - '\brave.exe'
  condition: selection_gas and not filter_browsers
falsepositives:
  - Enterprise automation tooling using Apps Script webhooks (inventory before tuning)
level: high
tags:
  - attack.command_and_control
  - attack.t1102.002
  - attack.t1071.001
status: experimental
author: Security Arsenal Threat Intel
---
title: Suspicious Masquerading DLL Load — CAV3RN Module Artifacts
description: Detects loading of DLLs named to blend with legitimate Windows components (CommunicationUxTheme.dll, GoogleService.dll, texture.dll, net.dll, rnp.dll) from non-system paths, matching CAV3RN's modular implant naming convention.
logsource:
  category: image_load
  product: windows
detection:
  selection_names:
    ImageLoaded|endswith:
      - '\CommunicationUxTheme.dll'
      - '\GoogleService.dll'
      - '\texture.dll'
      - '\rnp.dll'
  filter_system:
    ImageLoaded|startswith:
      - 'C:\Windows\System32\'
      - 'C:\Windows\SysWOW64\'
  condition: selection_names and not filter_system
falsepositives:
  - Game engines legitimately shipping texture.dll (validate signer and path)
level: critical
tags:
  - attack.defense_evasion
  - attack.t1036.005
  - attack.persistence
  - attack.t1574.002
status: experimental
author: Security Arsenal Threat Intel
date: 2026/09/13
KQL — Microsoft Sentinel / Defender
// Multi-campaign hunt: CAV3RN Apps Script C2, Kimwolf ENS resolution, crypto-extension exfil domains
let lookback = 14d;
let ext_c2 = dynamic(["j7tracker.io", "cloudflare.bonto.run", "susi.bonto.run", "studiotikva.com", "api.studiotikva.com", "ns1.studiotikva.com", "ns2.studiotikva.com"]);
let ens_rpc = dynamic(["eth.llamarpc.com", "cloudflare-eth.com", "rpc.ankr.com", "ethereum.publicnode.com", "mainnet.infura.io"]);
let browser_list = dynamic(["chrome.exe", "msedge.exe", "firefox.exe", "brave.exe"]);
union isfuzzy=true
(DeviceNetworkEvents
 | where TimeGenerated > ago(lookback)
 | where RemoteUrl has_any (ext_c2)
 | project Hunt="Extension/CAV3RN C2 Hit", TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP),
(DeviceNetworkEvents
 | where TimeGenerated > ago(lookback)
 | where RemoteUrl has_any (dynamic(["script.google.com", "script.googleusercontent.com"]))
 | where not(InitiatingProcessFileName in~ (browser_list))
 | project Hunt="CAV3RN Apps Script Relay (non-browser)", TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP),
(DeviceNetworkEvents
 | where TimeGenerated > ago(lookback)
 | where RemoteUrl has_any (ens_rpc)
 | where not(InitiatingProcessFileName in~ (browser_list))
 | project Hunt="Kimwolf ENS Blockchain C2", TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP),
(DeviceImageLoadEvents
 | where TimeGenerated > ago(lookback)
 | where FileName has_any (dynamic(["CommunicationUxTheme.dll", "GoogleService.dll", "texture.dll", "rnp.dll"]))
 | where not(FolderPath startswith @"C:\Windows\System32" or FolderPath startswith @"C:\Windows\SysWOW64")
 | project Hunt="CAV3RN Masquerading DLL Load", TimeGenerated, DeviceName, InitiatingProcessFileName, FolderPath, SHA256)
| sort by TimeGenerated desc
PowerShell
# Security Arsenal - Multi-Campaign IOC Hunt (Kimwolf v7 / CAV3RN / Malicious Crypto Extensions)
# Run elevated on Windows endpoints. Outputs findings to CSV.

$report = @()

# --- 1. CAV3RN masquerading DLLs on disk ---
$dllNames = @("CommunicationUxTheme.dll","GoogleService.dll","texture.dll","rnp.dll","net.dll")
foreach ($drive in (Get-PSDrive -PSProvider FileSystem).Root) {
    foreach ($dll in $dllNames) {
        try {
            Get-ChildItem -Path $drive -Filter $dll -Recurse -ErrorAction SilentlyContinue -Force |
              Where-Object { $_.FullName -notmatch "^C:\\Windows\\(System32|SysWOW64)" } |
              ForEach-Object {
                $report += [PSCustomObject]@{
                  Hunt="CAV3RN DLL on Disk"; Path=$_.FullName
                  Hash=(Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
                  Detail="Non-system-path load of masquerading module"
                }
              }
        } catch {}
    }
}

# --- 2. Kimwolf / CAV3RN / Extension IOC file hashes ---
$iocHashes = @(
  "421111a57b0a4224c052fa4108d90429d579974b5b5111ed2e58516ba09422ca",
  "951c94809aa6c7ab587125f9d4df30fa6a49ee0cbba76a4b7ceedaaa0e5dcd36",
  "345222bca004595977f971d76900b0c65fd9bf9d91c50cd0c5bf5a93f1ad9e49",
  "5b4fbe0658ff76f042c3cc2dfe3d1a3eda963e435a24dfc868cb583bde8c7b91"
)
$searchPaths = @("$env:TEMP","$env:LOCALAPPDATA","$env:APPDATA","C:\ProgramData")
foreach ($p in $searchPaths) {
    Get-ChildItem -Path $p -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
        if ($iocHashes -contains $h) {
            $report += [PSCustomObject]@{ Hunt="Known IOC Hash Match"; Path=$_.FullName; Hash=$h; Detail="Matches OTX pulse indicator" }
        }
    }
}

# --- 3. Active connections to extension C2 / CAV3RN staging domains ---
$badDomains = @("j7tracker.io","bonto.run","studiotikva.com")
Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ForEach-Object {
    try {
        $dns = (Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue).NameHost
        foreach ($d in $badDomains) {
            if ($dns -match [regex]::Escape($d)) {
                $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
                $report += [PSCustomObject]@{ Hunt="Live C2 Connection"; Path=$proc.Path; Hash=""; Detail="$($proc.Name) -> $dns ($($_.RemoteAddress))" }
            }
        }
    } catch {}
}

# --- 4. Persistence: Run keys & scheduled tasks referencing suspicious paths ---
$runKeys = @("HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run",
             "HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run")
foreach ($rk in $runKeys) {
    Get-ItemProperty -Path $rk -ErrorAction SilentlyContinue | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match "AppData|Temp|ProgramData" } | ForEach-Object {
            $report += [PSCustomObject]@{ Hunt="Suspicious Run Key"; Path="$rk -> $($_.Name)"; Hash=""; Detail=$_.Value }
        }
    }
}
Get-ScheduledTask -ErrorAction SilentlyContinue | Where-Object {
    $_.Actions.Execute -match "AppData|Temp" -and $_.TaskPath -notlike "\Microsoft\*"
} | ForEach-Object {
    $report += [PSCustomObject]@{ Hunt="Suspicious Scheduled Task"; Path=$_.TaskName; Hash=""; Detail=$_.Actions.Execute }
}

# --- 5. Browser extension artifacts (J7Tracker/VREO/Orbit/GhostApe) ---
$extNames = @("j7tracker","vreo","orbit tracker","ghostape")
Get-ChildItem "$env:LOCALAPPDATA\Google\Chrome\User Data\Default\Extensions" -Directory -ErrorAction SilentlyContinue | ForEach-Object {
    $manifest = Join-Path $_.FullName "*\manifest.json"
    Get-Content $manifest -ErrorAction SilentlyContinue | ForEach-Object {
        foreach ($n in $extNames) { if ($_ -match $n) {
            $report += [PSCustomObject]@{ Hunt="Malicious Browser Extension"; Path=$_.PSPath; Hash=""; Detail="Extension matching '$n' installed" }
        }}
    }
}

$report | Format-Table -AutoSize
$report | Export-Csv -Path ".\OTX_Hunt_Results_$(Get-Date -Format yyyyMMdd_HHmm).csv" -NoTypeInformation
Write-Host "[+] Hunt complete. $($report.Count) findings exported."

Response Priorities

Immediate (0–24h):

  • Push all SHA256 hashes and confirmed domains (j7tracker.io, cloudflare.bonto.run, susi.bonto.run, studiotikva.com and subdomains) to EDR blocklists, DNS sinkholes, and SWG URL blocks. Validate snapshot.xyz context before blocking.
  • Deploy the Sigma and KQL detections above; run the PowerShell hunt across endpoints prioritized to finance/trading teams and any Israeli-facing business units.
  • Inventory managed Android TV boxes / digital-signage devices; isolate any with exposed ADB (port 5555) or outdated kernels vulnerable to CVE-2016-5195.
  • Block egress from servers to script.google.com/script.googleusercontent.com for non-browser processes at the proxy, or alert-only if automation dependencies exist.

24h (identity-layer response — mandatory given session-token theft):

  • Identify all users of Axiom Trade, Padre, and browser-based crypto tooling; force revocation of all active sessions and API keys for any user with the malicious extensions installed — token theft means password resets alone are insufficient.
  • Audit IdP logs (Entra ID/Okta) for session anomalies: impossible travel, token replay from new ASN/device pairs, and wallet-address changes on trading accounts.
  • Enumerate installed browser extensions fleet-wide (Chrome/Edge/Firefox enterprise policies) and remove the four named families plus any unvetted crypto tooling.

1 week (architecture hardening):

  • Implement a browser extension allowlist via enterprise policy; default-deny all others for users in finance and executive roles.
  • Segment IoT/Android media devices onto a dedicated VLAN with no east-west access and strict egress (no blockchain RPC endpoints, no Tor directory authorities).
  • Deploy JA3/JA3S and HTTP/2 fingerprinting at the egress tier to counter Kimwolf's browser-mimicking floods; coordinate DDoS runbooks with your upstream scrubbing provider.
  • Add DNS analytics alerting on A-record-query bursts immediately preceding outbound HTTPS from the same host (CAV3RN channel-selection behavior).
  • Establish a control for cloud-service-as-C2: alert on any non-browser process communicating with Google Apps Script, Azure Functions, AWS Lambda URLs, or similar FaaS endpoints.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-malwarekimwolf-botnetcav3rn-espionagebrowser-extension-malwarecryptocurrency-theftiot-ddos

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action