Canadian Man Arrested for Building Kimwolf IoT Botnet Behind Massive DDoS Attacks
Check IoT device logs for unusual traffic patterns that could indicate botnet activity.
Check IoT device logs for unusual traffic patterns that could indicate botnet activity.
Summary
Canadian authorities arrested 23‑year‑old Jacob Butler, known online as Dort, for building and operating the Kimwolf IoT botnet that infected millions of devices such as digital photo frames and webcams. Kimwolf rented the compromised devices to other criminals and launched record‑smashing DDoS attacks, including a 30 Tbps assault on Department of Defense IP ranges that caused financial losses exceeding $1 million for some victims. The botnet issued more than 25,000 attack commands before authorities seized its infrastructure in March, and U.S. and Canadian law‑enforcement also seized three rival botnets—Aisuru, JackSkid, and Mossad—used by the same pool of vulnerable devices. Butler faces up to 10 years in U.S. prison if convicted, with mitigating factors such as youth and lack of prior record potentially reducing the sentence. The Department of Defense’s Defense Criminal Investigative Service and the FBI Anchorage office are actively investigating the case, while the Ontario Provincial Police executed a search warrant at Butler’s Ottawa residence, seizing multiple devices. Butler is currently in Canadian custody awaiting a hearing scheduled for May 26, with extradition to the U.S. pending.
Key changes
- Kimwolf botnet built by Jacob Butler (Dort) exploited millions of IoT devices, including digital photo frames and webcams
- Botnet rented infected devices to other criminals and executed DDoS attacks up to 30 Tbps, targeting DoD IP ranges
- Over 25,000 attack commands issued, causing financial losses exceeding $1 million for some victims
- U.S. and Canadian authorities arrested Butler, seized his infrastructure, and also seized three other botnets: Aisuru, JackSkid, Mossad
- DoD’s Defense Criminal Investigative Service and FBI Anchorage are investigating the case
- Butler faces up to 10 years in U.S. prison if convicted, with mitigating factors such as youth and lack of prior record