Alleged Kimwolf Botnet Administrator Jacob Butler Arrested in Canada
Summary
Canadian authorities arrested Jacob Butler, accused of helping administer the Kimwolf DDoS-for-hire botnet. Officials attribute more than 25,000 attacks to Kimwolf, and court records indicate it may have resumed operations after March takedowns.
Key points
- Jacob Butler was arrested in Ottawa and faces U.S. charges of aiding and abetting computer intrusions; he awaits extradition and faces up to 10 years if convicted.
- Authorities allege Butler, also known as “Dort,” was a principal administrator of Kimwolf, a variant of the Aisuru botnet.
- Officials say Kimwolf operated as a DDoS-for-hire service and initiated more than 25,000 attacks, causing outages, disruption and millions of dollars in losses.
- Authorities said they found evidence linking Kimwolf to DDoS attacks targeting Department of Defense Information Network IP addresses.
- An investigator cited overlapping IP addresses and account evidence in linking Butler to Kimwolf.
- Authorities seized infrastructure for Kimwolf and other botnets in March; court records indicate Kimwolf may have returned to operation.
Article Details
- Event Type
- Arrest and U.S. criminal charges against a man accused of helping administer the Kimwolf DDoS botnet.
- Impact
- Officials said Kimwolf launched more than 25,000 attacks, causing network outages, disruptions, and financial losses exceeding millions of dollars, and was linked to attacks targeting Department of Defense Information Network IP addresses. The botnet reportedly infected more than 2 million Android TV devices. Although authorities seized botnet infrastructure in March, court records suggest Kimwolf has returned to operation.
MITRE ATT&CK
People
Threat Actors
DortName Butler was also known by, according to the article; authorities allege Butler was a principal administrator of Kimwolf.Jacob ButlerAuthorities allege Butler was a principal administrator of Kimwolf and charged him with aiding and abetting computer intrusions; the allegations have not been established by a conviction.
Malware
AisuruThe case links Kimwolf to the Aisuru botnet family, major infrastructure seizures, and renewed botnet activity despite prior takedowns.JackskidAuthorities in March seized infrastructure powering the Kimwolf, Aisuru, JackSkid and Mossad botnets, which hijacked a combined three million devices and launched more than 300,000 DDoS attacks collectively.KimwolfAuthorities arrested Canadian national Jacob Butler, accused of helping run the Kimwolf DDoS botnet and using it to power thousands of attacks against government and other targets.MossadAuthorities in March seized infrastructure powering the Kimwolf, Aisuru, JackSkid and Mossad botnets, which hijacked a combined three million devices and launched more than 300,000 DDoS attacks collectively.