Jacob Butler Kimwolf arrest and cross-border charges
Law Enforcement
Summary
Hide ▲
Show ▼
Canadian authorities arrested Jacob Butler (“Dort”) in Ottawa over the Kimwolf DDoS botnet case. The move escalates a cross-border cybercrime prosecution that also includes an unsealed U.S. complaint and an extradition warrant. Investigators say Kimwolf powered massive distributed denial-of-service attacks, including traffic measured at nearly 30 Terabits per second. The arrest matters because the botnet allegedly caused million-dollar losses and remains tied to an ongoing effort to dismantle its operators and infrastructure.
Related Happenings
FBI seizure of NetNut proxy domains
Law Enforcement
H score33
First: 03.07.2026 12:35
Last: 03.07.2026 12:35
Sources 1
About this happening:
The **FBI** seized **NetNut** domains in a law-enforcement takedown of proxy infrastructure abused for **cybercrime**, disrupting a network that routed malicious traffic through r...
FBI seizure of NetNut proxy domains
Law EnforcementAbout this happening: The **FBI** seized **NetNut** domains in a law-enforcement takedown of proxy infrastructure abused for **cybercrime**, disrupting a network that routed malicious traffic through r...
FBI seizes NetNut and Popa botnet domains
Law Enforcement
H score34
First: 02.07.2026 22:27
Last: 02.07.2026 22:27
Sources 1
About this happening:
The **FBI** seized **hundreds of domains** tied to **NetNut** and the **Popa botnet**, disrupting infrastructure used for **abusive traffic** and **account-takeover activity**. Th...
FBI seizes NetNut and Popa botnet domains
Law EnforcementAbout this happening: The **FBI** seized **hundreds of domains** tied to **NetNut** and the **Popa botnet**, disrupting infrastructure used for **abusive traffic** and **account-takeover activity**. Th...
Kimwolf operators build a cybercrime-as-a-service DDoS access market
Threat Actor Meta
H score24
First: 22.05.2026 11:50
Last: 22.05.2026 11:50
Sources 1
How related:
The operators then used a 'cybercrime-as-a-service' model to sell access to the infected devices to other cybercriminals.
About this happening:
The **Kimwolf** operators ran a **cybercrime-as-a-service** market that sold access to infected devices, widening **DDoS-for-hire** abuse. The model turned compromised **digital p...
Kimwolf operators build a cybercrime-as-a-service DDoS access market
Threat Actor MetaHow related: The operators then used a 'cybercrime-as-a-service' model to sell access to the infected devices to other cybercriminals.
About this happening: The **Kimwolf** operators ran a **cybercrime-as-a-service** market that sold access to infected devices, widening **DDoS-for-hire** abuse. The model turned compromised **digital p...
Dort-linked DDoS, doxing, and swatting campaign against researchers
Campaign
H score38
First: 22.05.2026 00:50
Last: 22.05.2026 00:50
Sources 1
How related:
after the accused launched a volley of DDoS, doxing and swatting campaigns against this author and a security researcher.
About this happening:
The **Dort**-linked harassment campaign targeted **this author and a security researcher**, using **DDoS, doxing, and swatting** to intimidate the people investigating the operato...
Dort-linked DDoS, doxing, and swatting campaign against researchers
CampaignHow related: after the accused launched a volley of DDoS, doxing and swatting campaigns against this author and a security researcher.
About this happening: The **Dort**-linked harassment campaign targeted **this author and a security researcher**, using **DDoS, doxing, and swatting** to intimidate the people investigating the operato...
Finnish arrest and U.S. charges in Bouquet Scattered Spider case
Law Enforcement
H score45
First: 28.04.2026 18:39
Last: 28.04.2026 18:39
Sources 1
About this happening:
**Finnish law enforcement** arrested **Bouquet**, and **U.S. federal prosecutors** later charged him in a cross-border **Scattered Spider** cybercrime case. The charges include **...
Finnish arrest and U.S. charges in Bouquet Scattered Spider case
Law EnforcementAbout this happening: **Finnish law enforcement** arrested **Bouquet**, and **U.S. federal prosecutors** later charged him in a cross-border **Scattered Spider** cybercrime case. The charges include **...
Timeline
-
22.05.2026 00:50 1 articles · 1mo ago
Security publication identifies Dort as Kimwolf botmaster
Initial DisclosureA security publication identified Jacob Butler, also known as Dort, as the Kimwolf botmaster after linking email addresses, cybercrime-forum registrations, and posts to public Telegram and Discord servers, while Butler continued DDoS, doxing, and swatting campaigns against the author and a security researcher.
Show sources
- Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada — krebsonsecurity.com — 22.05.2026 00:50
-
22.05.2026 00:50 1 articles · 1mo ago
March 19 seizures target Kimwolf infrastructure and related devices
Campaign Scope UpdateOn March 19, authorities seized the technical infrastructure for Kimwolf and three other large DDoS botnets — Aisuru, JackSkid and Mossad — while a search warrant executed at Butler's Ottawa address led to the seizure of multiple devices.
Show sources
- Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada — krebsonsecurity.com — 22.05.2026 00:50
-
22.05.2026 00:50 2 articles · 1mo ago
Ottawa arrest and U.S./Canada charges against Butler
Legal Policy Action UpdateCanadian authorities arrested Jacob Butler, also known as Dort, in Ottawa pursuant to a U.S. extradition warrant, and an Alaska district court unsealed a criminal complaint charging him with operating the Kimwolf DDoS botnet while Ontario police charged him with unauthorized use of a computer, possession of a device to obtain unauthorized use of a computer system or to commit mischief, and mischief in relation to computer data.
Show sources
- Alleged Kimwolf Botmaster ‘Dort’ Arrested, Charged in U.S. and Canada — krebsonsecurity.com — 22.05.2026 00:50
- Canadian Man Arrested for Operating Kimwolf Botnet — www.securityweek.com — 22.05.2026 15:11