Canadian authorities have arrested a 23-year-old Ottawa man, Jacob Butler, also known online as "Dort," on charges related to the creation and operation of the Kimwolf botnet. The botnet, which allegedly enslaved millions of Internet of Things devices, was used in a series of massive distributed denial-of-service (DDoS) attacks over the past six months. Butler faces criminal hacking charges in both Canada and the United States.
A criminal complaint unsealed in an Alaska district court charges Butler with operating the Kimwolf DDoS botnet. The U.S. Department of Justice stated that Butler's arrest in Canada by the Ontario Provincial Police was executed under a U.S. extradition warrant. Butler is currently in Canadian custody awaiting an initial court hearing.
The Kimwolf botnet is accused of targeting devices that are typically firewalled from the internet, such as digital photo frames and web cameras. These compromised systems were allegedly rented out to other cybercriminals or compelled to participate in record-breaking DDoS attacks. The botnet was also linked to assaults that impacted Internet address ranges belonging to the Department of Defense. The Defense Criminal Investigative Service, with assistance from the FBI's Anchorage field office, is investigating the case.
The Justice Department indicated that Kimwolf was associated with DDoS attacks reaching nearly 30 Terabits per second, a volume described as a record for recorded DDoS attack activity. These attacks reportedly resulted in financial losses exceeding one million dollars for some victims. The Kimwolf botnet is alleged to have issued over 25,000 attack commands.
On March 19, U.S. authorities, in conjunction with international law enforcement, seized the technical infrastructure for Kimwolf and three other large DDoS botnets: Aisuru, JackSkid, and Mossad. These botnets were reportedly competing for the same pool of vulnerable devices.
Butler was identified as the Kimwolf botmaster in late February by KrebsOnSecurity, following an investigation into his various email addresses, cybercrime forum registrations, and public posts on Telegram and Discord. Despite efforts to track his identity, Butler allegedly continued to threaten and harass researchers who contributed to slowing the botnet's spread. He also claimed responsibility for at least two swatting incidents targeting the founder of Synthient, a security startup that helped address a critical vulnerability exploited by Kimwolf for rapid propagation.
Synthient's founder, Ben Brundage, expressed relief at Butler's apprehension, stating that he hopes the harassment will now cease. Investigators reportedly connected Butler to the Kimwolf botnet's administration through IP addresses, online account information, transaction records, and messaging application data obtained via legal processes. The criminal complaint suggests Butler did not significantly separate his real-world and cybercriminal identities.
In April, the Department of Justice, alongside European authorities, seized domain names associated with nearly four dozen DDoS-for-hire services. At least one of these services is said to have collaborated with Butler's Kimwolf botnet.
Following a search warrant executed at Butler's Ottawa residence on March 19, multiple devices were seized by the Ontario Provincial Police. Butler faces charges in Canada including unauthorized use of a computer, possession of a device for unauthorized computer system use or mischief, and mischief in relation to computer data. He is scheduled to remain in custody until his hearing on May 26.
If extradited to the United States, Butler faces one count of aiding and abetting computer intrusion. A conviction in a U.S. court could result in a maximum sentence of 10 years imprisonment, though this may be influenced by sentencing guidelines that consider factors such as youth, lack of prior criminal history, and cooperation with investigators.
