Canadian authorities have arrested a 23-year-old Canadian man suspected of managing an extensive botnet.

Allegedly, Jacob Butler, online also known as “Dort,” was involved in the development and operation of the KimWolf botnet, an infamous DDoS-for-hire service.

The botnet infected more than one million internet-connected devices worldwide, including webcams and digital photo frames, and other IoT hardware. Once compromised, the operators used a “cybercrime-as-a-service” model to sell access to the infected devices to other cybercriminals.

Infected devices were then forced to participate in DDoS attacks, targeting computers and servers located throughout the world, including Department of Defense Information Network (DoDIN) IP addresses.

The US Department of Justice claims that the botnet was linked to attacks reaching nearly 30 terabits per second, which is a record in DDoS attack volume. Authorities claim that the KimWolf botnet conducted more than 25,000 attack commands before law enforcement agencies disrupted its command-and-control (C2) infrastructure in March this year.

Law enforcement agencies were able to identify the Canadian suspect as the administrator of the botnet based on his IP addresses, online account details, transaction data, and chat conversations.

In addition, US authorities disrupted several DDoS platforms that collaborated with the KimWolf botnet. Visitors are redirected to a so-called splash page, which shows a warning that DDoS services are illegal.

Butler is charged with one count of aiding and abetting computer intrusion. If found guilty, he could face a prison sentence of up to 10 years.

Butler’s arrest follows a broader international crackdown launched in March targeting several major IoT botnets, including KimWolf, AISURU, JackSkid, and Mossad. The coordinated operation involved authorities from Canada, Germany, and the United States, alongside support from private-sector cybersecurity firms.

In February, cybersecurity expert Brian Krebs identified Butler as the Kimwolf botmaster after digging through his various email addresses, registrations on the cybercrime forums, and posts to public Telegram and Discord servers.

---

Unlock more exclusive Cybernews content on YouTube.