KimWolf Botnet Operator Arrested in Canada

Authorities arrested a Canadian man accused of operating the KimWolf botnet, a massive DDoS-for-hire platform linked to large-scale cyberattacks worldwide.

U.S. prosecutors identified the suspect as 23-year-old Jacob Butler, who allegedly used the online alias “Dort.” Investigators claimed he helped manage infrastructure tied to the KimWolf botnet, which reportedly infected more than one million internet-connected devices.

The arrest followed an international law enforcement operation targeting several major IoT botnets responsible for record-breaking distributed denial-of-service attacks.

Authorities Connected the Suspect to the Botnet

According to prosecutors, Butler allegedly operated the KimWolf botnet as a cybercrime-for-hire service. Customers could reportedly rent access to infected devices and launch DDoS attacks against websites, servers, and online services.

Investigators said the malware targeted poorly secured internet-connected devices, including:

• Web cameras
• Smart TVs
• Streaming devices
• Digital photo frames
• Other IoT hardware

Once infected, the devices became part of a massive botnet capable of generating enormous volumes of malicious traffic.

Authorities claimed the KimWolf botnet issued more than 25,000 attack commands before investigators disrupted parts of the infrastructure earlier this year.

Researchers also noted that many compromised devices likely belonged to ordinary consumers who had no idea their systems were participating in cyberattacks.

The KimWolf Botnet Powered Large DDoS Attacks

Investigators linked the KimWolf botnet to some of the largest DDoS attacks publicly reported in recent years.

According to authorities, certain attacks generated traffic volumes approaching 30 terabits per second. Some reports connected the infrastructure to attacks that exceeded 31 Tbps.

The attacks reportedly caused major service disruptions and financial damage for victims worldwide. Prosecutors said some organizations faced losses exceeding €880,000 due to outages, mitigation expenses, and recovery costs.

Authorities also claimed that some attacks targeted systems connected to the U.S. Department of Defense Information Network.

The case highlights how modern botnets continue growing in size and power as attackers exploit insecure IoT devices connected to the internet.

International Operation Targeted Multiple Botnets

The arrest followed a coordinated operation involving authorities from the United States, Canada, and Germany.

Investigators disrupted infrastructure connected to several major botnets, including KimWolf, Aisuru, JackSkid, and Mossad. Officials said the broader network infected more than three million devices worldwide.

Researchers explained that cybercriminals increasingly use compromised IoT hardware not only for DDoS attacks but also for proxy services and other illegal operations.

Cybersecurity companies and technology providers reportedly assisted law enforcement during the investigation and takedown efforts.

Conclusion

The KimWolf botnet case shows how dangerous large-scale IoT malware operations have become. Millions of compromised devices reportedly helped power cyberattacks capable of disrupting critical online services worldwide.

The arrest also demonstrates growing international cooperation against botnet operators and cybercrime-for-hire platforms. However, researchers continue warning that weak IoT security and outdated devices still create major opportunities for future botnet campaigns.