Canadian Man Arrested for Allegedly Operating KimWolf DDoS Botnet

International authorities have arrested Jacob Butler, a 23-year-old Canadian national, for his alleged role in operating the KimWolf distributed denial-of-service (DDoS) botnet. The botnet, described as a "cybercrime-as-a-service" operation, infected over a million devices worldwide and was used to launch massive DDoS attacks.

Key Takeaways

• Jacob Butler, also known online as "Dort," was arrested in Ottawa, Canada.

• He is charged with aiding and abetting computer intrusion and faces up to 10 years in prison.

• The KimWolf botnet targeted Internet of Things (IoT) devices and was used for DDoS-for-hire attacks.

• The botnet was linked to record-setting DDoS attacks, peaking at nearly 30 Terabits per second.

• This arrest follows a broader international operation that disrupted multiple botnets.

The KimWolf Botnet Operation

The KimWolf botnet specialized in compromising Internet-connected devices that are typically protected by firewalls, such as digital photo frames and webcams. These compromised devices were then enslaved and used by botnet operators to conduct DDoS attacks. This operation functioned on a "cybercrime-as-a-service" model, where access to the infected devices was sold to other cybercriminals.

Scale and Impact of Attacks

KimWolf is estimated to have issued over 25,000 attack commands. The botnet was linked to some of the largest recorded DDoS attacks, with traffic peaking at an astonishing 31.4 Terabits per second. These attacks resulted in significant financial losses for victims, with some experiencing losses exceeding one million dollars. The targets included computers and servers globally, even affecting Department of Defense Information Network (DoDIN) IP addresses.

Investigation and Arrest

Authorities linked Butler to the KimWolf botnet through various digital footprints, including IP address data, online account information, transaction records, and messages from platforms like Discord. Independent security journalist Brian Krebs was among the first to publicly identify Butler as the alleged operator.

Broader Law Enforcement Action

Butler's arrest is part of a larger, coordinated international effort. In March 2026, law enforcement agencies from the U.S., Canada, and Germany disrupted the command-and-control (C2) infrastructure associated with KimWolf, AISURU, JackSkid, and Mossad botnets. In a related action, seizure warrants were unsealed targeting online services that supported 45 DDoS-for-hire platforms, including at least one that collaborated with KimWolf, effectively dismantling these operations.

Sources

• Kimwolf DDoS Botnet Operator Arrested in Canada Over DDoS-for-Hire Attacks, The Hacker News.

• Suspected KimWolf botnet admin arrested over DDoS-for-hire operation, Help Net Security.

• Canada’s Jacob Butler arrested by international authorities, charged with KimWolf DDoS botnet attacks, Peoples Gazette Nigeria.

• Canadian Man Arrested for Running KimWolf DDoS Botnet Service that Hacked 2 Million Devices, CyberSecurityNews.

• Alleged leader of Kimwolf, a sweeping botnet for cybercriminals, arrested in Canada, CyberScoop.