Canadian authorities have arrested a 23-year-old Ottawa man on charges of creating and operating the Kimwolf botnet, one of the most destructive IoT botnets in recent years that infected millions of devices worldwide. Jacob Butler , known online as “ Dort ,” now faces criminal charges in both Canada and the United States for operating the botnet that caused record-breaking DDoS attacks .
See also: Researchers take down over 550 servers of the Kimwolf and Aisuru Botnet
According to a criminal complaint unsealed in an Alaska, Butler is accused of operating the Kimwolf DDoS botnet that primarily targeted Internet of Things such as digital photo frames, web cameras, DVRs and Wi-Fi routers. The U.S. Department of Justice announced that the complaint was unsealed after the defendant was arrested in Canada by Ontario Provincial Policeon a U.S. extradition warrant.
The Kimwolf botnet stood out for its speed of spread and its use of innovative infection techniques. Rather than relying solely on direct internet exposure, the botnet exploited weaknesses in residential proxy to reach devices located on internal networks. This tactic allowed attackers to infect devices traditionally protected by firewalls, dramatically expanding the range of potential targets.
Security researchers found that Kimwolf primarily targeted devices with weak security management, including digital video recorders, IP cameras, TV boxes , and other smart devices. The botnet was largely due to the use of default passwords and the lack of regular security updates on these devices.
The Department of Justice revealed that Kimwolf was responsible for DDoS attacks that reached 30 Terabits per second , making it a record for attack volume. These attacks caused financial damages that for some victims exceeded one million dollars . The botnet allegedly issued over 25,000 attack commands during its operation.
See also: Kimwolf Botnet has infected 1.8 million Android devices
Particularly concerning was the fact that some of the attacks affected US Department of Defense, which led to the involvement of the Defense Forensic Investigation Service in the investigation, with assistance from the FBI Anchorage office. The infected devices were rented to other cybercriminals or forced to participate in mass attacks targeting critical infrastructure.
The case gained publicity when Brian Krebs of KrebsOnSecurity revealed Butler 's identity in February 2026 after extensive research that included analyzing email addresses, cybercrime forum posts, and posts on Telegram and Discord servers . However, "Dort" responded with a harassment campaign that included DDoS attacks , doxing , and swatting against the journalist and security researchers.
On March 19, US authorities worked with international partners to seize the technical infrastructure of Kimwolf and three other large DDoS botnets – Aisuru, JackSkid , and Mossad – that were competing for the same population of vulnerable devices. Collectively, these botnets had infected more than 3 million devices worldwide, with hundreds of thousands in the United States.
Technical details and protection methods
Investigators linked Butler to running the Kimwolf botnet through IP addresses, online account information, transaction records and messaging app logs obtained through legal proceedings. The criminal complaint shows that Butler made minimal efforts to separate his real identity from his cybercriminal activities.
To protect against such threats, organizations should implement strict security measures for their IoT devices . This includes changing default passwords, regularly updating firmware , disabling unnecessary services, and separating IoT devices into separate networks. In addition, proxy service providers should strengthen access controls and monitor for abuse patterns.
See also: SocksEscort Botnet Dismantled by Law Enforcement Authorities
Butler 's arrest is a significant victory in the fight against IoT botnets , but it also highlights the need for constant vigilance and improved security measures across all connected devices. As Krebs on Security reports , the case shows how international cooperation can lead to successful results against cybercriminals.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
