hu, 21 May 2026
← BackCanadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS) attacks over the past six months. KrebsOnSecurity publicly named the suspect in February 2026 after the accused launched a volley of DDoS, doxing and swatting campaigns against this author and a security researcher. He now faces criminal hacking charges in both Canada and the United States. A criminal complaint unsealed today in an Alaska district court charges Jacob Butler, a.k.a.
“Dort,” of Ottawa, Canada with operating the Kimwolf DDoS botnet. A statement from the Department of Justice says the complaint against Butler was unsealed following the defendant’s arrest in Canada by the Ontario Provincial Police pursuant to a U.S. extradition warrant. Butler is currently in Canadian custody awaiting an initial court hearing scheduled for early next week.
The government said Kimwolf targeted infected devices which were traditionally “firewalled” from the rest of the internet, such as digital photo frames and web cameras. The infected systems were then rented to other cybercriminals, or forced to participate in record-smashing DDoS attacks, as well as assaults that affected Internet address ranges for the Department of Defense. Consequently, the DoD’s Defense Criminal Investigative Service is investigating the case, with...
Canadian authorities on Wednesday arrested a 23-year-old Ottawa man on suspicion of building and operating Kimwolf, a fast spreading Internet-of-Things botnet that enslaved millions of devices for use in a series of massive distributed denial-of-service (DDoS) attacks over the past six months. KrebsOnSecurity publicly named the suspect in February 2026 after the accused launched a volley of DDoS, doxing and swatting campaigns against this author and a security researcher. He now faces criminal hacking charges in both Canada and the United States. A criminal complaint unsealed today in an Alaska district court charges Jacob Butler, a.k.a.
“Dort,” of Ottawa, Canada with operating the Kimwolf DDoS botnet. A statement from the Department of Justice says the complaint against Butler was unsealed following the defendant’s arrest in Canada by the Ontario Provincial Police pursuant to a U.S. extradition warrant. Butler is currently in Canadian custody awaiting an initial court hearing scheduled for early next week.
The government said Kimwolf targeted infected devices which were traditionally “firewalled” from the rest of the internet, such as digital photo frames and web cameras. The infected systems were then rented to other cybercriminals, or forced to participate in record-smashing DDoS attacks, as well as assaults that affected Internet address ranges for the Department of Defense. Consequently, the DoD’s Defense Criminal Investigative Service is investigating the case, with assistance from the FBI field office in Anchorage. “KimWolf was tied to DDoS attacks which were measured at nearly 30 Terabits per second, a record in recorded DDoS attack volume,” the Justice Department statement reads.
“These attacks resulted in financial losses which, for some victims, exceeded one million dollars. The KimWolf botnet is alleged to have issued over 25,000 attack commands.” On March 19, U.S. authorities joined international law enforcement partners in seizing the technical infrastructure for Kimwolf and three other large DDoS botnets — named Aisuru, JackSkid and Mossad — that were all competing for the same pool of vulnerable devices. On February 28, KrebsOnSecurity identified Butler as the Kimwolf botmaster after digging through his various email addresses, registrations on the cybercrime forums, and posts to public Telegram and Discord servers.
However, Dort continued to threaten and harass researchers who helped track down his real-life identity and dramatically slow the spread of his botnet. Dort claimed responsibility for at least two swatting attacks targeting the founder of Synthient, a security startup that helped to secure a widespread critical security weakness that Kimwolf was using to spread faster and more effectively than any other IoT botnet out there. Synthient was among many technology companies thanked by the Justice Department today, and Synthient’s founder Ben Brundage told KrebsOnSecurity he’s relieved Butler is in custody. “Hopefully this will end the harassment,” Brundage said.
An excerpt from the criminal complaint against Butler, detailing how he ordered a swatting attack against Ben Brundage, the founder of the security firm Synthient. The government says investigators connected Butler to the administration of the KimWolf botnet through IP address, online account information, transaction records, and online messaging application records obtained through the issuance of legal process. The criminal complaint against Butler (PDF) shows he did little to separate his real-life and cybercriminal identities (something we demonstrated in our February unmasking of Dort). In April, the Justice Department joined authorities across Europe in seizing domain names tied to nearly four-dozen DDoS-for-hire services, although because of a bureaucratic mix-up the list of seized domains has remain sealed until today.
The DOJ said at least one of those services collaborated with Butler’s Kimwolf botnet. A statement from the Ontario Provincial Police said a search warrant was executed on March 19 at Butler’s address in Ottawa, where they seized multiple devices. As a result of that investigation, Butler was arrested and charged this week with unauthorized user of computer; possession of device to obtain unauthorized use of computer system or to commit mischief; and mischief in relation to computer data. He is scheduled to remain in custody until a hearing on May 26.
In the United States, Butler is facing one count of aiding and abetting computer intrusion. If extradited, tried and convicted in a U.S. court, Butler could face up to 10 years in prison, although that maximum sentence would likely be heavily tempered by considerations in the U.S. Sentencing Guidelines, which make allowances for mitigating factors such as youth, lack of criminal history and level of cooperation with investigators.
This entry was posted on Thursday 21st of May 2026 05:50 PM Yikes… Not sure what to think about this one. I expected this to happen quite quickly. Dort claimed he lived in Hong Kong, but you don’t have to be a genius to know that he wasn’t in Hong Kong. hello codingfire I have been battling DOS bots for months and very intensely for the past 2 weeks.
It was starting to take up most of my working hours. I actually wrote a new, dynamic IP-blocker because of it this past weekend. I fail to see that any downward sentencing deviations are appropriate. To me, the volume of machines and their users victimized by this sicko makes a large UPWARD deviation in sentence appropriate.
He is a digital predator of other humans. And in his personal attempts to instigate violence against journalists that could have resulted in their death, he is every bit the monster that John Dioguardi (aka Johnny Dio) was when he had acid thrown in a journalist’s face. Life imprisonment should be given serious consideration. I agree.
Swatting should be prosecuted as attempted murder. If their attacks effect US Govt infrastructure in any way they should be handled as terrorists. yikes “….allowances for mitigating factors such as youth, lack of criminal history and level of cooperation with investigators.” And that is the problem! He swatted people and he will get the proverbial “slap on the wrist”.
he also did carding with dortgen but idk if hes getting charged with that If he goes to prison, he’ll very quickly learn the meaning of “prison Bride”. He’ll also learn very quickly not to pick up bars of soap on the shower floor. Not everybody destined to have a painful path like you had bud. Yeah.
Wait until he buys someone’s “crypto coin” and gets pardoned “as a hero.” Krebs I kindly request that you delete this article about my Boyfriend Dort. Keiron Ellison Dongfeng Botnet Finally my competition is gone! couldn’t last without this guy uninstalling me off all the ADB Alex Tyler Mossad Botnet On conviction assign him to work for Pentagon Pete, taking notes with a #2 pencil on paper only. Commendations, Brian, on both your digital sleuthing and reporting.
The thoughtful & purposeful way you apply your skills and diligence to such matters benefits all of us. Thank you. https://ottawacitizen.com/news/local-news/what-is-going-on-in-ottawa-handcuffing-of-another-child-with-autism-worries-advocates Eviate, Are you suggestng that Jacob Butler is autistic? What does that matter given that Jacob is capable of creating/running Kimwolf Botmaster?
just showing one of the many warning signs he’s shown before that this individual is a danger to others nothing more. If you read the article he threw a chair at another invidual, showing his lack of self control and critical thinking even at a young age. more privated stuff butler doesnt want to be shown below btw. https://www.youtube.com/watch?v=Jaj5xqmkxKc Yikes.
The video is private. Any more links to him? How do you know the handcuffed boy is him? Danger to society maybe, but eviate lets be fr you js as problematic as dort except can’t form real social relationships so you have a gaggle of slow teenagers following you around spreading ur stuff for u.
Talking about some “danger to society” from an altruistic standpoint as if you don’t do the same activity lmfao. also him being autistic likely will lead to him getting 0 real charges in Canada for his actions which we all want to see (its been known he’s autistic he’s been doxxed before but he paid to remove it lol) kimwolf on top sir! Your email address will not be published. Required fields are marked * Comment * Name * Email * Website Δ Mailing List Search KrebsOnSecurity Recent Posts Story Categories Why So Many Top Hackers Hail from Russia