Canadian Man Arrested in Alleged Kimwolf Botnet Case as U.S. and Canada File Charges

Canadian authorities have arrested a 23-year-old Ottawa man accused of helping run Kimwolf, a fast-growing Internet-of-Things botnet linked to large-scale distributed denial-of-service attacks over the past six months. U.S. prosecutors also unsealed a criminal complaint tied to the same case, making the suspect subject to charges in both countries.

The man, identified in court filings as Jacob Butler and known online as “Dort,” was taken into custody by the Ontario Provincial Police under a U.S. extradition warrant. He remains in Canadian custody pending an initial court hearing scheduled for next week.

Botnet alleged to have abused connected devices

According to the Justice Department, Kimwolf infected devices that were often assumed to be isolated behind firewalls, including digital photo frames and internet-connected cameras. Investigators say the compromised systems were then used to launch massive DDoS attacks or rented to other criminals. The government said some of the attacks reached nearly 30 terabits per second and caused financial losses that, in some cases, exceeded $1 million.

Officials also said the botnet issued more than 25,000 attack commands and was used in operations affecting internet address ranges associated with the Department of Defense. The Defense Criminal Investigative Service and the FBI office in Anchorage are assisting with the case.

Earlier public identification and harassment claims

The suspect was publicly identified earlier this year by KrebsOnSecurity after an investigation into email addresses, forum accounts and messages posted on public chat platforms. After that identification, the suspect allegedly carried out harassment campaigns, including threats, doxing and swatting incidents targeting researchers and a security startup founder.

One of the companies thanked by federal investigators, Synthient, had helped secure a vulnerability that Kimwolf reportedly relied on to spread more quickly. Company founder Ben Brundage said he was relieved to hear of the arrest.

In Canada, Butler faces charges including unauthorized use of a computer, possession of a device used to gain unauthorized access or commit mischief, and computer-related mischief. In the United States, he is charged with aiding and abetting computer intrusion. If extradited and convicted in U.S. court, he could face up to 10 years in prison, though any sentence would be determined under federal guidelines.