Kimwolf DDoS Botnet Operator Arrested in Canada Over DDoS-for-Hire Attacks

A Canadian man, Jacob Butler, was arrested and charged for developing and operating the Kimwolf distributed denial-of-service botnet. Kimwolf was assessed as a variant of AISURU and targeted infected devices that were typically firewalled from the broader internet, including digital photo frames and web cameras. The infected devices were controlled by botnet operators and were forced to participate in DDoS attacks against computers and servers worldwide, including Department of Defense Information Network IP addresses. The operators used a cybercrime-as-a-service model to sell access to infected devices to other cybercriminals. Court documents linked Butler to Kimwolf administration through IP address data, online account information, and Discord message records. Authorities previously disrupted related command-and-control infrastructure in a coordinated operation.

"Kimwolf targeted infected devices which were traditionally 'firewalled' from the rest of the internet, such as digital photo frames and web cameras. The infected devices were enslaved by the botnet operators. The operators then used a 'cybercrime-as-a-service' model to sell access to the infected devices to other cybercriminals. The operators and their customers forced the victim devices to participate in DDoS attacks, targeting computers and servers located throughout the world, including Department of Defense Information Network (DoDIN) IP addresses."

"Court documents show that Butler was linked to the administration of the KimWolf botnet through IP address, online account information, and Discord message records posted by an account called resi[.]to. That Butler was behind the Kimwolf botnet was first exposed by independent security journalist Brian Krebs earlier this February. At that time, the defendant claimed that he had not used the "Dort" persona since 2021 and that some other party was impersonating him after compromising his old account."

"The charges come exactly two months after U.S. authorities, in partnership with Canada and Germany, disrupted the command-and-control (C2) infrastructure associated with Kimwolf, AISURU, JackSkid, and Mossad as part of a court-authorized law enforcement operation. Per the DoJ, Kimwolf is estimated to have issued over 25,000 attack commands. Prior to their takedown, the AISURU/Kimwolf botnets were attributed to some of the record-setting DDoS attacks to date, flooding targets with junk traff"

Read at The Hacker News