Dort-linked DDoS, doxing, and swatting campaign against researchers
Campaign
Summary
Hide ▲
Show ▼
The Dort-linked harassment campaign targeted this author and a security researcher, using DDoS, doxing, and swatting to intimidate the people investigating the operator and increase personal risk. The activity mattered because it added a coordinated abuse thread to the broader Kimwolf botnet case and aimed to slow attribution work. The campaign was later cut short by Butler’s arrest, but the documented operation shows repeated, targeted harassment rather than a one-off threat.
Related Happenings
Kimwolf operators build a cybercrime-as-a-service DDoS access market
Threat Actor Meta
First: 22.05.2026 11:50
Last: 22.05.2026 11:50
Sources 1
About this happening:
The **Kimwolf** operators ran a **cybercrime-as-a-service** market that sold access to infected devices, widening **DDoS-for-hire** abuse. The model turned compromised **digital p...
Kimwolf operators build a cybercrime-as-a-service DDoS access market
Threat Actor MetaAbout this happening: The **Kimwolf** operators ran a **cybercrime-as-a-service** market that sold access to infected devices, widening **DDoS-for-hire** abuse. The model turned compromised **digital p...
Jacob Butler Kimwolf arrest and cross-border charges
Law Enforcement
First: 22.05.2026 00:50
Last: 22.05.2026 00:50
Sources 1
How related:
A criminal complaint unsealed today in an Alaska district court charges Jacob Butler, a.k.a. “Dort,” of Ottawa, Canada with operating the Kimwolf DDoS botnet.
About this happening:
Canadian authorities **arrested Jacob Butler (“Dort”)** in **Ottawa** over the **Kimwolf DDoS botnet** case. The move escalates a **cross-border cybercrime prosecution** that also...
Jacob Butler Kimwolf arrest and cross-border charges
Law EnforcementHow related: A criminal complaint unsealed today in an Alaska district court charges Jacob Butler, a.k.a. “Dort,” of Ottawa, Canada with operating the Kimwolf DDoS botnet.
About this happening: Canadian authorities **arrested Jacob Butler (“Dort”)** in **Ottawa** over the **Kimwolf DDoS botnet** case. The move escalates a **cross-border cybercrime prosecution** that also...
DoJ/FBI/USSS crypto-fraud domain seizure and charges
Law Enforcement
First: 27.04.2026 18:00
Last: 27.04.2026 18:00
Sources 1
About this happening:
**DoJ**, **FBI**, and **US Secret Service** investigators **seized 503 domains** linked to **fraudulent crypto platforms**, disrupting infrastructure used in a Cambodia-based scam...
DoJ/FBI/USSS crypto-fraud domain seizure and charges
Law EnforcementAbout this happening: **DoJ**, **FBI**, and **US Secret Service** investigators **seized 503 domains** linked to **fraudulent crypto platforms**, disrupting infrastructure used in a Cambodia-based scam...
Aisuru, KimWolf, JackSkid, and Mossad botnet C2 takedown
Law Enforcement
First: 20.03.2026 10:05
Last: 20.03.2026 10:05
Sources 1
About this happening:
The **U.S. Department of Justice** announced the arrest of **Jacob Butler (aka Dort)**, a **23-year-old** in **Ottawa, Canada**, for allegedly developing and operating the **Kimwo...
Aisuru, KimWolf, JackSkid, and Mossad botnet C2 takedown
Law EnforcementAbout this happening: The **U.S. Department of Justice** announced the arrest of **Jacob Butler (aka Dort)**, a **23-year-old** in **Ottawa, Canada**, for allegedly developing and operating the **Kimwo...
Dort Kimwolf retaliatory harassment campaign
Campaign
First: 28.02.2026 14:01
Last: 28.02.2026 14:01
Sources 1
About this happening:
The **Dort**-controlled **Kimwolf** operation escalated into a **targeted harassment campaign** against the researcher and the author, combining **DDoS**, **doxing**, and **email...
Dort Kimwolf retaliatory harassment campaign
CampaignAbout this happening: The **Dort**-controlled **Kimwolf** operation escalated into a **targeted harassment campaign** against the researcher and the author, combining **DDoS**, **doxing**, and **email...
Timeline
-
21.05.2026 03:00 2 articles · 6d ago
KrebsOnSecurity identifies Jacob Butler as Kimwolf botmaster
Initial DisclosureKrebsOnSecurity publicly identifies 23-year-old Ottawa man Jacob Butler, a.k.a. Dort, as the operator behind Kimwolf after linking email addresses, cybercrime-forum registrations, and public Telegram and Discord activity to the alias. The naming follows DDoS, doxing and swatting campaigns against the author and a security researcher.
Show sources
- Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada — krebsonsecurity.com — 22.05.2026 00:50
- Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada — krebsonsecurity.com — 22.05.2026 00:50
-
21.05.2026 03:00 1 articles · 6d ago
Ontario police search Butler's Ottawa address and seize devices
Legal Policy Action UpdateOn March 19, the Ontario Provincial Police execute a search warrant at Butler's Ottawa address and seize multiple devices as investigators move against the Kimwolf operator. U.S. authorities also seize Kimwolf technical infrastructure the same day, disrupting the operation that had been used for large-scale DDoS abuse and harassment activity tied to researchers.
Show sources
- Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada — krebsonsecurity.com — 22.05.2026 00:50
-
21.05.2026 03:00 1 articles · 6d ago
Canadian authorities arrest Jacob Butler and a U.S. complaint is unsealed
Legal Policy Action UpdateCanadian authorities arrest Jacob Butler, a.k.a. Dort, in Ottawa on suspicion of building and operating Kimwolf, and an Alaska criminal complaint is unsealed charging him with aiding and abetting computer intrusion. He remains in Canadian custody pending a May 26 hearing, marking the latest dated enforcement step in the case.
Show sources
- Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada — krebsonsecurity.com — 22.05.2026 00:50