BotnetPublished 21 May 2026

Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada

Source Krebs on Security

Description

Jacob Butler, a 23-year-old from Ottawa, Canada, was arrested for allegedly operating the Kimwolf IoT botnet, which enslaved millions of devices to conduct massive distributed denial-of-service (DDoS) attacks over six months. The botnet targeted devices like digital photo frames and web cameras, including those behind firewalls, and was involved in record-breaking DDoS attacks reaching nearly 30 Tbps. Butler faces criminal charges in both Canada and the U.S., including unauthorized computer use and aiding computer intrusion. Law enforcement seized Kimwolf's infrastructure along with other competing botnets. The botnet caused significant financial losses exceeding one million dollars for some victims and was linked to harassment campaigns such as doxing and swatting against security researchers. The investigation involved multiple agencies including the FBI and the Department of Defense. No specific software versions are identified as affected, and no patch or remediation is applicable as this concerns criminal activity rather than a software vulnerability.

Impact

The Kimwolf botnet caused massive distributed denial-of-service attacks with volumes reaching nearly 30 terabits per second, resulting in significant financial losses for victims, some exceeding one million dollars. The botnet enslaved millions of IoT devices, including those traditionally firewalled from the internet, and was rented out to other cybercriminals. It also targeted critical infrastructure such as Department of Defense IP address ranges. Additionally, the botnet operator engaged in harassment activities including doxing and swatting of security researchers. The criminal activity disrupted internet services and posed risks to public and governmental networks.

Defensive guidance

This threat pertains to criminal activity involving a botnet operator rather than a software vulnerability. Law enforcement has arrested the alleged operator and seized the botnet infrastructure. Organizations should continue to apply best practices for securing IoT devices and monitor for residual botnet activity. No direct mitigation actions are specified or required beyond ongoing law enforcement efforts.

Summary

The Kimwolf botnet, operated by Jacob Butler, was a large-scale Internet-of-Things botnet that enslaved millions of devices to conduct unprecedented DDoS attacks, including assaults on Department of Defense IP ranges. The botnet issued over 25,000 attack commands and was involved in financial damages exceeding one million dollars for some victims. Butler was identified through digital forensics linking IP addresses, online accounts, and transaction records. Law enforcement actions included seizure of botnet infrastructure and arrest of the alleged operator. The botnet exploited a critical security weakness in IoT devices to spread rapidly. Butler also engaged in harassment campaigns against security researchers. The case is under investigation by multiple U.S. and Canadian authorities, with criminal charges filed in both countries. There is no indication of a software vulnerability or patch; this is a criminal botnet operation.

References

krebsonsecurity.com/2026/05/alleged-kimwolf-botmaster-dort-arrested-charged-in-u-s-and-canada/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 18 Jun 2026, 22:01 UTC

References

Community reviews

Related threats