Canadian Man Arrested for Administering KimWolf DDoS Botnet
Canadian Man Arrested for Administering KimWolf DDoS Botnet 🚨
According to court documents, on April 10, 2026, U.S. authorities criminally charged Jacob Butler, aka “Dort,” 23, of Ottawa, Canada, with offenses related to the development and operation of the KimWolf botnet. KimWolf was a DDoS-for-hire service that infected over a million devices worldwide, including devices located in Alaska. The complaint remained sealed pending Butler’s arrest.
Following coordination with the U.S. Department of Justice and the Department of Defense Office of Inspector General’s Defense Criminal Investigative Service (DCIS), Butler was taken into custody yesterday in Ottawa, Canada, pursuant to an extradition warrant.
KimWolf was tied to DDoS attacks which were measured at nearly 30 Terabits per second, a record in recorded DDoS attack volume. These attacks resulted in financial losses which, for some victims, exceeded one million dollars. The KimWolf botnet is alleged to have issued over 25,000 attack commands.
In addition to Butler’s arrest, the Central District of California unsealed seizure warrants which targeted online services supporting 45 DDoS-for-hire platforms.
Additionally, the U.S. Justice Department thanks Akamai, Amazon Web Services, Cloudflare, DigitalOcean, Epieos, Google, Hydrolix, Lumen, Nokia, Oracle, PayPal, Registrar of Last Resort, Salesforce Counter-Threat Ops, The Shadowserver Foundation, Sony Interactive Entertainment, SpyCloud, Synthient, Team Cymru, Unit 221B, XLAB, and EUROPOL’s PowerOFF team for their assistance provided during this investigation and operation. 🙏