⏱ 3 min read
Jacob Butler, a 23-year-old Canadian man, was arrested in Ottawa, Canada, for operating the notorious KimWolf Distributed Denial of Service (DDoS) Internet of Things (IoT) botnet. The botnet infected over a million devices worldwide, including devices in Alaska, and was used to launch massive DDoS attacks, including one that reached a record 30 Terabits per second. The attacks targeted computers and servers globally, including Department of Defense Information Network (DoDIN) IP addresses. The arrest was made on April 10, 2026, following a joint operation between US authorities and international law enforcement partners.
The KimWolf botnet was a DDoS-for-hire service that targeted traditionally ‘firewalled’ devices such as digital photo frames and web cameras. The infected devices were then used to launch DDoS attacks, which were sold as a ‘cybercrime as a service’ to other cybercriminals. The attacks resulted in significant financial losses for the victims.
Butler, also known as ‘Dort’, was charged with offenses related to the development and operation of the KimWolf botnet. The charges were filed in the District of Alaska, and the complaint was unsealed following his arrest. The case is a significant victory for law enforcement in the fight against cybercrime, and demonstrates the importance of international cooperation in combating these types of threats.
The investigation was conducted by the US Department of Justice and the Department of Defense Office of Inspector General’s Defense Criminal Investigative Service (DCIS), in partnership with international law enforcement partners. The operation to seize the Command and Control (C2) infrastructure used by the KimWolf botnet was conducted in March 2026, and was a major blow to the cybercriminals behind the botnet.
📋 Key Facts
- Crime: Cybercrime
- Defendant: Alaska
- Location: AK
- Source: DOJ Press Release
