Dort

Dort is an individual cybercriminal associated with the Aisuru/Kimwolf botnet ecosystem and with the use of compromised consumer devices and malicious residential proxy infrastructure for distributed denial-of-service operations. Reporting links Dort to control of the Aisuru/Kimwolf botnet alongside at least one other operator, and identifies Dort as an emerging actor who adapted residential proxy networks themselves into a DDoS botnet vector. The actor is tied to Kimwolf and its predecessor Aisuru, botnets associated with mass compromise of unofficial Android TV streaming boxes and related consumer devices. These botnets have been used both to relay abusive traffic for proxy services and to conduct large-scale DDoS attacks. Dort has been specifically associated with exploiting residential proxy ecosystems as an attack substrate, reaching roughly 400,000 exploited IPs in a single day during peak activity in early 2026. Operationally, the activity linked to Dort overlaps with botnet-enabled proxy abuse, large-scale traffic relaying, and destructive or disruptive network attacks. The broader Aisuru/Kimwolf ecosystem has also been linked to resilient command-and-control approaches, including use of Ethereum Name Service records for control-server discovery and operator messaging, as well as retaliatory harassment and DDoS activity against researchers and organizations investigating the botnet. Known associated names in this ecosystem include Kimwolf, Aisuru, and the alleged co-operator Snow.