The Kimwolf Aftershock: Residential Proxy Botnets One Year Later#

Craig Labovitz – Nokia; Chinni Tadivaka (joint Comcast Threat Research Lab / Nokia ERT research)

• Why: Residential-proxy-driven DDoS is now a backbone-scale security problem — attacks saturating transit and POP links, not just enterprise targets — and this is the rare talk with a year of longitudinal data on what disruption actually achieved.
• What: The follow-up to NANOG 94's warning: law-enforcement and provider takedowns measurably cut US outbound DDoS, but Kimwolf metastasized into 21+ successor botnets ("ResHydra") reusing the same ADB-based residential exploits; daily active DDoS botnet endpoints climbed from ~1M (summer 2025) to 8M+ (2026), aggregate capacity in the hundreds of Tbps, with 100+ Tbps rated as a potential threat to most national networks. The economics: 75% of res-proxy attacks originate from US or Brazilian homes; the multi-billion-dollar proxy market is now funded largely by AI scraping demand; and gigabit symmetric broadband keeps raising upstream capacity.
• How: Measurement via large-scale crawling, a botnet security range, licensed third-party data, and collaborating ISPs/hosting providers. The concrete remedy demonstrated: one LATAM ISP enabling C2-blocking ACLs on May 7, 2026 saw an immediate multi-Tbps drop in outbound DDoS — infrastructure reliability genuinely equals disrupting botnet C2 in your network.
• Where applicable: Most relevant to ISPs/backbones and anyone operating consumer-facing access networks. Research artifacts are published (github.com/deepfield/public-research). The C2-disruption remedy is real but constrained by accuracy, policy, and legal concerns — which is exactly why NA adoption lags.