In Brief: The 23-year-old Jacob Butler from Ottawa was arrested and charged with operating the Kimwolf botnet, which exploited millions of IoT devices for record-breaking DDoS attacks reaching up to 30 terabits per second. Butler also conducted threats and swatting attacks against security researchers.
Canadian authorities arrested a 23-year-old man from Ottawa on Wednesday, suspected of developing and operating Kimwolf – a rapidly spreading Internet-of-Things botnet that has enslaved millions of devices for massive DDoS attacks. Jacob Butler, also known as “Dort”, now faces charges in both Canada and the United States.
Canadian authorities arrested a 23-year-old man from Ottawa on Wednesday, who is accused of developing and operating the Kimwolf botnet. The highly infectious Internet-of-Things botnet has exploited millions of devices over the past six months for massive distributed denial-of-service attacks (DDoS).
Jacob Butler, known under the pseudonym “Dort”, faces serious hacking charges in both Canada and the United States. The Department of Justice revealed charges against Butler today in Alaska, following his arrest by the Ontario Provincial Police based on a U.S. extradition warrant. Butler is currently in Canadian custody and awaiting a hearing scheduled for next week.
Kimwolf targeted devices that were traditionally isolated from the rest of the Internet – such as digital picture frames and webcams. The infected systems were either rented out to other cybercriminals or forcibly used for DDoS attacks, in some cases also against U.S. Department of Defense infrastructure.
According to the Department of Justice, DDoS attacks associated with Kimwolf reached record levels of nearly 30 terabits per second – a historic milestone. Some victims suffered financial losses exceeding one million dollars. The botnet is said to have distributed over 25,000 attack commands.
Butler was publicly named by KrebsOnSecurity in February 2026 after launching doxing, swatting, and DDoS campaigns against a security researcher and the report’s author. Despite his identification, he continued his threats and harassment. He is accused of ordering at least two swatting attacks against Ben Brundage, the founder of security firm Synthient.
In March, international law enforcement agencies joined forces to seize the infrastructure of Kimwolf and three other major DDoS botnets – Aisuru, JackSkid, and Mossad.