Loading story…
Callum Dare, a 26-year-old man from Talbot Green, Wales, was sentenced to two years and three months in prison after admitting he encouraged and assisted swatting attacks linked to the dark-web doxing platform Doxbin. Investigators said Dare used Doxbin’s #deadnet channel to egg on attackers, help identify targets, and circulate edited montage videos showing armed police and emergency responses to hoax incidents in the United Kingdom, United States, and Canada. Authorities tied him to incidents including a nail-bomb hoax in Cardiff and a bomb threat involving a University of California lecture theatre, even though he did not personally place the false emergency calls.
The case began after the FBI passed intelligence to South Wales Police and the Tarian Regional Organised Crime Unit, which identified Dare through digital evidence, chat logs, and a PayPal account. Dare pleaded guilty to encouraging or assisting malicious communications and to possessing articles for use in fraud after police found a phishing kit known as "The Man in the Onion" on his devices, although investigators said there was no evidence it had been deployed in a real-world attack. The prosecution highlights that people who facilitate or promote swatting online can face criminal penalties even without making the hoax reports themselves.
See the reporting duties and controls this puts on the clock.
5 events from the most recent confirmed update back to the earliest known activity.
Callum Dare was sentenced to two years and three months in prison for encouraging and assisting swatting attacks linked to Doxbin across the United Kingdom, United States, and Canada.
Dare pleaded guilty to encouraging or assisting malicious communications and possession of articles for use in frauds in connection with his support for swatting activity and the phishing kit found on his devices.
During the investigation, police found a phishing kit called "The Man in the Onion" on Dare's devices, resulting in an additional fraud-related charge, though no evidence showed it had been used in real-world attacks.
Authorities tied Callum Dare, identified as a Doxbin administrator, to the platform's related chat activity and multiple swatting incidents in the UK, US, and Canada using digital evidence, chat logs, and a PayPal account.
In 2019, the FBI contacted South Wales Police and the Tarian Regional Organised Crime Unit, triggering an investigation into swatting activity linked to Doxbin.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcemalware.news
Open sourcedarkwebinformer.com
Open sourcetheregister.com
Open sourcecps.gov.uk
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
UK authorities said Justin Swaddle, a 20-year-old from Leeds linked to the online collective known as **The Com**, was sentenced to two years in prison for blackmail, sextortion, and child sexual abuse offences against **117 female victims worldwide**. Investigators said Swaddle, who offended while aged 17, used aliases including **"Epstein," "Rugen," and "Moscow"** on Snapchat, Telegram, and Discord to groom and coerce girls aged 13 to 17 into producing sexual images and videos, and in some cases into acts of self-harm, while threatening to expose them to parents or schools. The UK National Crime Agency said it took over the investigation in January 2024 and recovered evidence from seized devices showing indecent images of children, extortion, and material depicting victims carving his aliases into their skin. Eight victims were identified in the UK, with additional victims located through cooperation with law enforcement in the United States, Canada, Australia, Norway, and New Zealand. Swaddle pleaded guilty at Leeds Crown Court and was also made subject to a **10-year Sexual Harm Prevention Order** and placement on the **Sex Offenders Register**, as authorities highlighted the case as part of wider scrutiny of The Com over sextortion, child exploitation, and related cyber-enabled abuse.
Aug 10, 2026
U.S. and Canadian authorities arrested 23-year-old Ottawa resident Jacob Butler, also known as **"Dort,"** and unsealed charges alleging he was a principal administrator of the **Kimwolf** DDoS botnet. Prosecutors said Kimwolf was a variant of the **Aisuru** botnet and part of a broader ecosystem that hijacked millions of internet-connected devices, including more than 2 million Android TV devices and other IoT hardware such as webcams and digital photo frames. Investigators said the botnet enabled hundreds of thousands of attacks, issued more than 25,000 attack commands, and was linked to DDoS activity reaching nearly **30 Tbps**, including attacks affecting Department of Defense network IP ranges. Authorities said Butler was identified through overlapping IP usage, Google account artifacts, machine cookies, Discord and messaging records, transaction data, and other account information. Canadian officials arrested him on a U.S. extradition warrant while also filing domestic computer crime charges, and the Justice Department said law enforcement had already seized infrastructure tied to **Kimwolf**, **Aisuru**, **JackSkid**, and **Mossad** in March. Court records and reporting indicate Kimwolf resumed operations after that takedown, and the case also includes allegations that Butler harassed security researchers and claimed responsibility for swatting attacks against Synthient founder Ben Brundage after the company helped mitigate a flaw that Kimwolf had exploited for rapid spread.
Jun 29, 2026
Romanian national **Thomasz Szabo**, 27, was sentenced in U.S. District Court to **48 months in prison** for leading an online swatting and bomb-threat ring that targeted more than **75 public officials**, multiple journalists, and **four religious institutions**. U.S. prosecutors said Szabo founded and ran an online community beginning in late 2020 that carried out false emergency reports and explosive threats, including a mass-shooting threat against New York City synagogues and a threat involving the **U.S. Capitol** and then-President-elect Joe Biden. He pleaded guilty in June 2025 to conspiracy and threats involving explosives after being extradited from Romania in November 2024. Authorities said the campaign escalated into a concentrated swatting spree from **Dec. 24, 2023, through early January 2024**, hitting at least 25 members of Congress, six senior executive branch officials, 13 senior federal law enforcement officials, federal judges, 27 state officials, and other targets. The Justice Department said the operation drained law enforcement resources, wasted taxpayer funds, and created serious risks for civilians and responding officers. The investigation involved the **U.S. Secret Service**, **FBI**, **U.S. Capitol Police**, Justice Department international offices, and Romanian authorities, while alleged Serbian accomplice **Nemanja Radovanovic** faces separate proceedings.
Jun 29, 2026