Canadian Arrested for Operating Massive Kimwolf DDoS Botnet
Jacob Butler, 23, of Ottawa, was arrested in Canada and faces U.S. extradition for operating the Kimwolf botnet, which infected over a million IoT devices globally. The botnet launched record-breaking DDoS attacks up to 31.4 Tbps, targeting U.S. Department of Defense IPs and causing millions in losses. International law enforcement seized its infrastructure in March 2026. Butler faces up to 10 years for aiding computer intrusions.
Cross-source coverage
Wire timeline
Canadian man arrested for running KimWolf DDoS botnet
Jacob Butler, a 23-year-old Canadian, was arrested in Ottawa on Wednesday after the U.S. Justice Department filed an extradition warrant for his alleged operation of the KimWolf botnet, one of the largest DDoS-for-hire platforms globally. Court documents unsealed on Thursday reveal that KimWolf infected over a million devices worldwide, including digital photo frames and web cameras, and was used to launch record-breaking DDoS attacks measured at nearly 30 Terabits per second. The botnet was taken down in March as part of an international law enforcement operation involving the U.S., Canada, Germany, and cybersecurity firms. Butler faces one count of aiding and abetting computer intrusion, carrying a maximum sentence of 10 years. Prosecutors noted that victims suffered financial losses exceeding one million dollars, and at least one attack targeted IP addresses owned by the U.S. Department of Defense. The DOJ also unsealed seizure warrants targeting other DDoS-for-hire platforms linked to KimWolf.
The Record from Recorded Future NewsSuspected KimWolf Botnet Admin Arrested Over DDoS-for-Hire Operation
U.S. and Canadian authorities arrested Jacob Butler, a 23-year-old Canadian man known online as 'Dort,' for allegedly operating the KimWolf DDoS botnet. The botnet infected over one million internet-connected devices worldwide, including digital photo frames and web cameras, and was rented out through a cybercrime-as-a-service model. KimWolf launched record-breaking DDoS attacks measured at nearly 30 Terabits per second, causing financial losses exceeding one million dollars for some victims and issuing over 25,000 attack commands. Targets included Department of Defense Information Network IP addresses. Butler was arrested in Canada under an extradition warrant and faces one count of aiding and abetting computer intrusion, carrying up to 10 years in prison. The arrest follows a March 2026 international operation that disrupted infrastructure linked to KimWolf and three other botnets. In a related action, seizure warrants targeted 45 DDoS-for-hire platforms.
Help Net SecurityCanadian Man Arrested for Operating Kimwolf DDoS Botnet
The U.S. Department of Justice announced the arrest of Jacob Butler, a 23-year-old Canadian from Ottawa, for allegedly operating the Kimwolf DDoS botnet. Kimwolf, a variant of AISURU, infected Android devices with exposed Android Debug Bridge (ADB) services, including digital photo frames and web cameras. The botnet enslaved these devices and sold access to other cybercriminals via a cybercrime-as-a-service model, launching DDoS attacks worldwide, including against Department of Defense Information Network (DoDIN) IP addresses. Butler was linked to the botnet through IP address, online accounts, and Discord messages. The arrest follows a February 2025 investigation by journalist Brian Krebs and a coordinated takedown by U.S., Canadian, and German authorities. Kimwolf issued over 25,000 attack commands and was responsible for record-setting DDoS attacks peaking at 31.4 Tbps. Butler faces one count of aiding and abetting computer intrusion, carrying up to 10 years in prison.
The Hacker NewsAlleged leader of Kimwolf, a sweeping botnet for cybercriminals, arrested in Canada
Jacob Butler, a 23-year-old from Ottawa, Canada, was arrested on Wednesday and awaits extradition to the United States for allegedly running Kimwolf, a massive DDoS botnet. The botnet, a variant of the Aisuru botnet, infected over 2 million Android TV devices and launched more than 25,000 attacks, causing millions in losses and targeting Department of Defense IP addresses. Butler, known online as 'Dort,' faces up to 10 years in prison for aiding and abetting computer intrusions. Authorities seized infrastructure in March but the botnet reportedly resumed operations. Investigators identified Butler through operational security lapses, including overlapping IP addresses across his personal accounts and Discord accounts linked to Kimwolf. The case highlights ongoing challenges in securing IoT devices against botnet operators.
CyberScoopAlleged Kimwolf Botmaster 'Dort' Arrested in Canada, Faces US Charges
Canadian authorities arrested 23-year-old Jacob Butler, known as 'Dort,' in Ottawa for building and operating the Kimwolf IoT botnet. The botnet enslaved millions of devices for massive DDoS attacks, including a record 30 Tbps assault, causing financial losses exceeding $1 million for some victims. Butler faces criminal hacking charges in both Canada and the United States. The US Department of Justice unsealed a complaint following his arrest by Ontario Provincial Police under a US extradition warrant. The botnet targeted vulnerable IoT devices like digital photo frames and web cameras. KrebsOnSecurity had publicly identified Butler in February 2026 after he launched DDoS, doxing, and swatting campaigns against the author and a security researcher. Law enforcement seized Kimwolf's infrastructure in March 2026 alongside three other botnets. Butler is in Canadian custody awaiting a court hearing.
Krebs on Security