The €30 attack box: inside the Android TV botnet ecosystem#

Jérôme Meyer, Nokia

• Why: Documents a step-change in the DDoS and abuse landscape — botnets no longer scan for exposed IoT; they recruit via residential proxy SDKs pre-installed on consumer hardware, behind CGNAT, invisible to conventional scanning.
• What: Nokia Deepfield's analysis of the Oct 2025 33 Tbps attack and the ecosystem behind it: budget Android TV boxes ship with proxy software that routes requests to 0.0.0.0 — which resolves to the device's own loopback, where an unauthenticated ADB shell listens. No scanning, no CVE; the proxy SDK delivers the victim. Kimwolf alone runs ~3M active bots with ENS-based C2; the exploitable surface is estimated at 100–200M endpoints.
• How: Linking six botnet families via shared code, a common cryptographic fingerprint (RC4+LCG, fixed seed), and co-located infrastructure; notable capabilities include Katana compiling its rootkit on-device via a bundled C compiler and CECbot abusing HDMI-CEC to survive factory resets. Operator-facing impact: outbound attack traffic from your own subscribers causes CGNAT failures and peering congestion; C2 signals to monitor are provided.
• Where applicable: Any access network operator (CGNAT/peering impact), and security teams tracking proxy/botnet infrastructure. Nokia-authored but built on original lab analysis and reverse engineering.