Loading story…
U.S. and Canadian authorities arrested 23-year-old Ottawa resident Jacob Butler, also known as "Dort," and unsealed charges alleging he was a principal administrator of the Kimwolf DDoS botnet. Prosecutors said Kimwolf was a variant of the Aisuru botnet and part of a broader ecosystem that hijacked millions of internet-connected devices, including more than 2 million Android TV devices and other IoT hardware such as webcams and digital photo frames. Investigators said the botnet enabled hundreds of thousands of attacks, issued more than 25,000 attack commands, and was linked to DDoS activity reaching nearly 30 Tbps, including attacks affecting Department of Defense network IP ranges.
Authorities said Butler was identified through overlapping IP usage, Google account artifacts, machine cookies, Discord and messaging records, transaction data, and other account information. Canadian officials arrested him on a U.S. extradition warrant while also filing domestic computer crime charges, and the Justice Department said law enforcement had already seized infrastructure tied to Kimwolf, Aisuru, JackSkid, and Mossad in March. Court records and reporting indicate Kimwolf resumed operations after that takedown, and the case also includes allegations that Butler harassed security researchers and claimed responsibility for swatting attacks against Synthient founder Ben Brundage after the company helped mitigate a flaw that Kimwolf had exploited for rapid spread.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
U.S. prosecutors unsealed a criminal complaint charging Butler with serving as a principal administrator of Kimwolf, described as a variant of the Aisuru botnet. The Justice Department said the broader botnet ecosystem hijacked millions of devices and enabled hundreds of thousands of DDoS attacks, including attacks affecting Department of Defense IP ranges.
Canadian authorities arrested 23-year-old Jacob Butler, known as “Dort,” in Canada for allegedly building and administering the Kimwolf botnet. The arrest was made under a U.S. extradition warrant, and Canadian authorities also filed domestic computer crime charges.
Court records cited in reporting indicate Kimwolf resumed operations despite the March infrastructure seizure. This showed the botnet remained active after the initial law enforcement disruption.
Law enforcement seized infrastructure tied to Kimwolf on March 19, alongside the Aisuru, JackSkid, and Mossad botnets. Officials also linked at least one seized DDoS-for-hire service to Butler’s operation.
Prior reporting by KrebsOnSecurity identified Ottawa resident Jacob Butler, also known as “Dort,” in connection with the Kimwolf botnet. The article states this identification occurred in February 2026.
Qianxin XLab published a report on the Kimwolf botnet, describing it as a massive operation that had infected 1.8 million Android devices worldwide. The report represents an early public technical disclosure of the botnet before the later 2026 attribution and law enforcement actions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
11 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecybersecuritynews.com
Open sourcesecurityaffairs.com
Open sourcethehackernews.com
Open sourcecyberscoop.com
Open sourcekrebsonsecurity.com
Open sourcebsi.bund.de
Open sourcelinkedin.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported explosive growth of the **Kimwolf** botnet to **2+ million infected devices** globally, with heavy concentrations including Vietnam, Brazil, India, Saudi Arabia, Russia, and the United States. Synthient assessed that roughly **two-thirds of infections are insecure Android TV boxes**, and described Kimwolf’s primary impact as large-scale abuse traffic (ad fraud, account takeover attempts, scraping) and **high-capacity DDoS** capable of disrupting major websites for extended periods. A key concern is Kimwolf’s propagation method: leveraging **residential proxy networks** to effectively tunnel “back” into home/SMB networks via proxy endpoints and then infect additional devices that users assume are protected behind NAT/firewalls and consumer routers. KrebsOnSecurity further tied operational activity to the botnet controller, a threat actor using the handle **“Dort,”** who allegedly retaliated against a vulnerability discloser and the journalist with **DDoS, doxing, email flooding**, and an apparent **SWATing** incident. Open-source and commercial intelligence cited in the reporting linked “Dort” to historical aliases (e.g., **CPacket**, **M1ce**) and to accounts on cybercrime forums, and noted prior involvement in enabling abuse tooling (e.g., CAPTCHA-bypass code and temporary email services) and presence in communities associated with cybercrime groups (including references to **LAPSUS$** chat activity).
Jun 29, 2026
U.S., Canadian, and German authorities disrupted the command-and-control infrastructure of four major IoT botnets — **Aisuru, KimWolf, JackSkid, and Mossad** — that collectively compromised more than **three million** internet-connected devices worldwide. Investigators said the botnets, built largely from vulnerable **DVRs, IP cameras, web cameras, and enterprise Wi‑Fi routers**, were used in hundreds of thousands of distributed denial-of-service attacks, including operations targeting **U.S. Department of Defense** systems, other high-value networks, and critical infrastructure. Officials said the malware networks were capable of generating traffic above **30 Tbps**, with one attack reaching roughly **31.4 Tbps**, placing them among the largest DDoS threats recorded. The operators allegedly ran the infrastructure as a **DDoS-for-hire** service and also used it for extortion, threatening victims with sustained attacks unless they paid. The U.S. action, led by the Defense Criminal Investigative Service with support from the FBI Anchorage Field Office, included seizure warrants for domains and virtual servers, while Germany’s **BKA** and Canada’s **RCMP** carried out parallel enforcement steps. Private-sector partners including **Akamai, AWS, Cloudflare, Team Cymru, and The Shadowserver Foundation** supported the disruption. Authorities said the takedown degraded the botnets’ ability to operate, but warned that the underlying risk remains because millions of infected or insecure devices are still online with weak credentials or outdated firmware.
Jun 29, 2026
The **Kimwolf** “Internet of Things” botnet has been linked to major disruption of the anonymity network **I2P (Invisible Internet Project)** after botnet operators began using I2P to help evade takedown efforts against their command-and-control (C2) servers. I2P users reported that tens of thousands of new “routers” suddenly flooded the network, many unable to pass traffic, overwhelming I2P to the point that legitimate users could not connect; developers and users described extreme connection counts and a sharp drop in successful connections consistent with a large-scale availability attack. Separately, a major U.S. ISP reported actively **sinkholing/blocking traffic to hundreds of botnet C2 servers** associated with Kimwolf (and the related **Aisuru** botnet), citing more than **550** identified C2 endpoints over several months. Reporting attributes Kimwolf’s growth to at least **~2 million infected devices**, with operators leveraging compromised **Android TV set-top boxes** and scanning for exposed **Android Debug Bridge (ADB)** services to expand the botnet and monetize access via **residential proxy** infrastructure that makes malicious traffic appear to originate from consumer networks.
Jun 29, 2026