The $30 attack box: inside the Android TV botnet ecosystem

In October 2025, Nokia Deepfield observed a 33 Tbps DDoS attack against a gaming provider, a volume exceeding the total capacity of many national backbones. Terabit-scale attacks are now a daily occurrence, with 78% of campaigns wrapping up in under five minutes. The era of scanning for exposed IoT devices has given way to something bigger: residential proxy networks with over 100 million consumer endpoints ready to fire on demand.

Your subscribers bought a $30 streaming box to cut the cord. The box had other plans. Budget Android TV devices routinely ship with residential proxy software baked in at the factory. These devices arrive pre-compromised, not due to user negligence, but through supply chain compromise. The proxy software makes them visible and accessible to botnet operators, who move in and add DDoS capability on top.

This presentation starts with Kimwolf, a botnet we studied in a controlled malware lab and through real-world Netflow telemetry. But the research didn't stop there. By tracing shared code, overlapping infrastructure, and reused credentials across samples, we mapped an ecosystem of eight botnet families, four of which share code, cryptographic material, and infrastructure. What looked like independent campaigns turned out to be a connected ecosystem spanning DDoS-for-hire and residential proxy monetization, with over three million devices observed.

Along the way, we found things we hadn't seen before. CECbot, a successor within one of the families, is the first known malware to weaponize HDMI-CEC, the protocol that lets your TV remote control other devices. Your subscribers' TV box is not quite Skynet, but it is scanning the home network and it can turn itself back on. Katana ships a C compiler inside the malware package and compiles its own rootkit directly on the infected TV box. Jackskid fell back to blockchain-based domain resolution within hours of having its C2 domains seized.

The operational security does not always match the ambition. One family disguises its C2 servers behind domains like `hikvision-cctv[.]su`, because if you're going to run a botnet of set-top boxes, you might as well dress your infrastructure up as security cameras. Another went with `boatdealers[.]su` — a Soviet-era boat dealership, the last place anyone would look for DDoS infrastructure.